Analysis
- max time kernel
46s - max time network
48s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
07/10/2022, 10:39
General
- Target 721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe
- Size 922KB
- Sample221007-mpyyeacbh4
- SHA256 721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16
Malware Config
Extracted
-
formbook
-
eauu
-
IRggpIEMsKxn0Rq4Id/GqZoQ
-
YX2UFOdW3jsCMwAvISAPjELmWQ==
-
lNnrH5nDcdiUyuj01Q==
-
DCE97vEWLg57mfJR/3dJ
-
C5Wv54zLS7Z9q3CFIlcz4w==
-
7/QTus0ECeRZc8pTciuLfKQW
-
jJnfzQIu+9OvjtQB3w==
-
oq3NgpO8zLiABpQ8oy/GqZoQ
-
rg1m0qLva2gmo/lR/3dJ
-
i13E7HyuV3UlgN4=
-
ShB7qDZpBnA7esbjyA==
-
YWd19sUzzMApebWSBn5L
-
z5PaxhseO4jhyuj01Q==
-
tE+AicQIFwk1iORz
-
1CNxuzuIlIRQehSgwoVP
-
+L4XEmOhp41SzkHMw8iJg14=
-
KSU96gdPZ082oLF8c8E=
-
7Cxv2Jvcas6Yyuj01Q==
-
+odzOl2gtpPkB8/mYxgXjELmWQ==
-
uM3oo6EEgGfH3DjGwciJg14=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe"C:\Users\Admin\AppData\Local\Temp\721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe"C:\Users\Admin\AppData\Local\Temp\721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1108-60-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1108-61-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1108-63-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1108-65-0x0000000000890000-0x0000000000B93000-memory.dmp
memory/2020-54-0x0000000000D30000-0x0000000000E1C000-memory.dmp
memory/2020-55-0x00000000756B1000-0x00000000756B3000-memory.dmp
memory/2020-56-0x00000000003D0000-0x00000000003E6000-memory.dmp
memory/2020-57-0x00000000003E0000-0x00000000003EC000-memory.dmp
memory/2020-58-0x00000000060C0000-0x000000000614C000-memory.dmp
memory/2020-59-0x0000000000B70000-0x0000000000BA2000-memory.dmp