Analysis
- max time kernel
46s - max time network
45s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
07/10/2022, 03:28
General
- Target SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe
- Size 879KB
- Sample221007-d1b4cabffp
- SHA256 b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28
Malware Config
Extracted
-
formbook
-
wyhq
-
+J2MBqYTckIf+ggtwXQy
-
VW3OLmLkxIM41y9uUg==
-
eigFKJyIR9FZHnnTir5mKA==
-
+wtyCE8SNrYKMq4G3TY=
-
I7i7JZFXdVTYueYsJZGRzr6WRJOhYpQqbw==
-
t9EecYbu3Nd0YLMgkx+gma8PMg==
-
vOlSjolRC9FRZfNOSg==
-
CLF1pC+Z9tBm9QQtwXQy
-
MyyhGj7EzIxkPYk=
-
nDkTcNtUaieyjuhAIIaNMIXGfApY25sucg==
-
WAMMat1j8OidAH7Qir5mKA==
-
mKEyo3VImmQ+5ihgSw==
-
Oku9EfGnSV861aYIjieA8oENd0JtcQ==
-
mRjzRxDUfXt4l/5DQw==
-
Cbq4KcE3qXX9nK0MXv8mEd2E
-
ZZUT6ovcMbuZAQ==
-
PC1+vr+mMbuZAQ==
-
U2WxDyeJgIA5OYLp8pdeDoE=
-
+EfNPwlkSxf6Vuz3rwl6NQ==
-
sksRbxGH2CAfNYg=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/956-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/956-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/956-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/956-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/956-67-0x0000000000401000-0x000000000042F000-memory.dmp
memory/956-68-0x0000000000B10000-0x0000000000E13000-memory.dmp
memory/1488-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp
memory/1488-56-0x0000000000390000-0x00000000003A8000-memory.dmp
memory/1488-57-0x0000000000340000-0x000000000034C000-memory.dmp
memory/1488-58-0x0000000005CF0000-0x0000000005D80000-memory.dmp
memory/1488-59-0x0000000000BC0000-0x0000000000BF4000-memory.dmp
memory/1488-54-0x0000000000170000-0x0000000000250000-memory.dmp