Analysis
- max time kernel
50s - max time network
47s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
07/10/2022, 12:40
General
- Target 4429cdfd2c41797b77ec6b466a96ecbbf6aa4662e615be16add1597e938398dc.exe
- Size 773KB
- Sample221007-pv75dacffq
- SHA256 4429cdfd2c41797b77ec6b466a96ecbbf6aa4662e615be16add1597e938398dc
Malware Config
Extracted
-
formbook
-
etfh
-
7GZ6EDICLTxRlA==
-
PLtlQESN4qcH
-
Hl1Kaj5k/IbeqjD2BbfAIAg=
-
IGIFzYb9FfCCzV9l
-
i6XHgFSN4qcH
-
OJwysQEOtacTgw==
-
sA02ZDlg/cQuq8OHbjJrZj5hZfBW2hA=
-
4RW/U8ADLezCD/fcwg==
-
3B8SJMhHZuG8DjTuj7wqNA==
-
YYEwzTC4Qw4gaIUlH4jx
-
Ues8V/VDLTxRlA==
-
xA958bGoMrQ=
-
YKOQqIa0Qwqq9IR2
-
VoV5nnq7XeY/BZmK2BtWmyiCrQ==
-
O/cKZyK2Wdw386OK9NobskQM
-
k50X1qTOYjVFGrU=
-
+T65goQJnSnD0sqxeMT78ktXVOho4BQ=
-
uJapUOj3EKOK0BjGpf4ePA==
-
QNs2VScpggMYnsh0
-
Z7XOfidNLTxRlA==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4429cdfd2c41797b77ec6b466a96ecbbf6aa4662e615be16add1597e938398dc.exe"C:\Users\Admin\AppData\Local\Temp\4429cdfd2c41797b77ec6b466a96ecbbf6aa4662e615be16add1597e938398dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4429cdfd2c41797b77ec6b466a96ecbbf6aa4662e615be16add1597e938398dc.exe"C:\Users\Admin\AppData\Local\Temp\4429cdfd2c41797b77ec6b466a96ecbbf6aa4662e615be16add1597e938398dc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4429cdfd2c41797b77ec6b466a96ecbbf6aa4662e615be16add1597e938398dc.exe"C:\Users\Admin\AppData\Local\Temp\4429cdfd2c41797b77ec6b466a96ecbbf6aa4662e615be16add1597e938398dc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/536-54-0x0000000000C90000-0x0000000000D58000-memory.dmp
memory/536-55-0x0000000076871000-0x0000000076873000-memory.dmp
memory/536-56-0x00000000004F0000-0x0000000000506000-memory.dmp
memory/536-57-0x0000000000680000-0x000000000068C000-memory.dmp
memory/536-58-0x0000000007CA0000-0x0000000007D2C000-memory.dmp
memory/536-59-0x0000000002160000-0x0000000002192000-memory.dmp
memory/2028-60-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2028-61-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2028-63-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2028-65-0x00000000008D0000-0x0000000000BD3000-memory.dmp