Analysis
- max time kernel
91s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
07/10/2022, 10:39
General
- Target 721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe
- Size 922KB
- Sample221007-mpyyeacbh4
- SHA256 721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16
Malware Config
Extracted
-
formbook
-
eauu
-
IRggpIEMsKxn0Rq4Id/GqZoQ
-
YX2UFOdW3jsCMwAvISAPjELmWQ==
-
lNnrH5nDcdiUyuj01Q==
-
DCE97vEWLg57mfJR/3dJ
-
C5Wv54zLS7Z9q3CFIlcz4w==
-
7/QTus0ECeRZc8pTciuLfKQW
-
jJnfzQIu+9OvjtQB3w==
-
oq3NgpO8zLiABpQ8oy/GqZoQ
-
rg1m0qLva2gmo/lR/3dJ
-
i13E7HyuV3UlgN4=
-
ShB7qDZpBnA7esbjyA==
-
YWd19sUzzMApebWSBn5L
-
z5PaxhseO4jhyuj01Q==
-
tE+AicQIFwk1iORz
-
1CNxuzuIlIRQehSgwoVP
-
+L4XEmOhp41SzkHMw8iJg14=
-
KSU96gdPZ082oLF8c8E=
-
7Cxv2Jvcas6Yyuj01Q==
-
+odzOl2gtpPkB8/mYxgXjELmWQ==
-
uM3oo6EEgGfH3DjGwciJg14=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe"C:\Users\Admin\AppData\Local\Temp\721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe"C:\Users\Admin\AppData\Local\Temp\721eee38b9c975862181aac88a3b7ff58666f4eae5db7b8b3eaf37d13fa4eb16.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1800-132-0x0000000000CB0000-0x0000000000D9C000-memory.dmp
memory/1800-133-0x0000000005B50000-0x00000000060F4000-memory.dmp
memory/1800-134-0x0000000005640000-0x00000000056D2000-memory.dmp
memory/1800-135-0x0000000005620000-0x000000000562A000-memory.dmp
memory/1800-136-0x00000000094A0000-0x000000000953C000-memory.dmp
memory/1800-137-0x00000000095B0000-0x0000000009616000-memory.dmp
memory/1912-139-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1912-140-0x0000000001250000-0x000000000159A000-memory.dmp