Analysis
- max time kernel
91s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/09/2022, 03:59
General
- Target c8a4cfffb04d6f2600fab0c1cbc55a44.exe
- Size 800KB
- Sample220929-ej3emsagdk
- SHA256 4072ef77c0ab086cc41e0e997d147b0bf5e8473db4c34eaa4a9024fc7207c18c
Malware Config
Extracted
-
formbook
-
nogs
-
0QX/9DdhLWWLw7Pwzfhf5yU=
-
4ME/nPMH090p8HPEGx5dVxLO
-
qKR7eOYftf1zXiEifMYvLmMuJg==
-
JJSU5dw5YXD0d2s8DX8=
-
Oswop1ZfvA3184JL
-
oRINXD2zP3SqX+VhbbWt
-
EuBl9mCqx1y+OGz4xPhf5yU=
-
HzQUJOyHZZ8aiproM/hf5yU=
-
Uz0PDH6iU5rKxfLIKw==
-
2Rj67a0BR3Xm3ZRhbbWt
-
caiYqWzga7w/VJeL+2g=
-
ZsarhfIos/sWa2s8DX8=
-
S7mv5KwdA0xKms4=
-
XIJ2cLXbwB1Pj5bgwvhf5yU=
-
bvZO26EFz88k+qlDE5C7O74qeDs=
-
S6iEuJr2zx69SpFFWaCn
-
CuBpAne3DF+cX+JhbbWt
-
S8EsyZv10glJAms8DX8=
-
z7UwlfUb//w3/HTBISh0HTI=
-
sN5pmG1ziZE=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8a4cfffb04d6f2600fab0c1cbc55a44.exe"C:\Users\Admin\AppData\Local\Temp\c8a4cfffb04d6f2600fab0c1cbc55a44.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c8a4cfffb04d6f2600fab0c1cbc55a44.exe"C:\Users\Admin\AppData\Local\Temp\c8a4cfffb04d6f2600fab0c1cbc55a44.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1876-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1876-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1876-142-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1876-143-0x0000000001230000-0x000000000157A000-memory.dmp
memory/3060-132-0x0000000000910000-0x00000000009DC000-memory.dmp
memory/3060-133-0x00000000059E0000-0x0000000005F84000-memory.dmp
memory/3060-134-0x0000000005370000-0x0000000005402000-memory.dmp
memory/3060-135-0x0000000005430000-0x000000000543A000-memory.dmp
memory/3060-136-0x0000000007DF0000-0x0000000007E8C000-memory.dmp
memory/3060-137-0x0000000008000000-0x0000000008066000-memory.dmp