Analysis
- max time kernel
56s - max time network
44s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
18/10/2022, 10:33
General
- Target IMG20221018-56789098765560890.exe
- Size 1.0MB
- Sample221018-mlhr1sfffl
- SHA256 49139beffbec5c8b7f4f11e82112e0972f60de6b7064456b1cec936d5dd20cec
Malware Config
Extracted
-
formbook
-
s5zx
-
wMAY83Xf8pYlwmcLm5HvBdaL
-
CEtcpyGISM/CVFQ5zam3
-
jQE/nMmnXlmcTVQ5zam3
-
kUtRVpN/YY33wLfac81TKg==
-
WxtrRs8s52o/GPsPog==
-
w8LUN0UWABcTD1Hv
-
pCU+Wnk+6/E08im2Xo5y7uea
-
4o2dnKCJNOgbwud9JfMHrMJuAGI+fg==
-
AbPNtFXXpcoeyWB1WGC/AOiS
-
5Kbo75EKwcLiArHSoc/SIg==
-
IaICXWtqc2xvU++OXEd+tRitdw==
-
x0M6GKkDC8SPQGd/S61UdfgVZLqVDFg=
-
Y6TEJKsC3IxVJN986uJugqNcN7NO5EU=
-
rltiOepgaw3Mk0Lbt1yoxuA=
-
z94mjMxyFcLUu1Q=
-
xH3F3Hz93BCSMuBtI65JGm+VN3xm
-
+GO142npuuptGPsPog==
-
WX/VsE7R0FTm3Ju2ema/AOiS
-
qam0OKkfCyE6ZKxZtQ==
-
0ojGr0OMV9khz+4GoA==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1076-54-0x0000000001200000-0x000000000130C000-memory.dmp
memory/1076-55-0x0000000075C51000-0x0000000075C53000-memory.dmp
memory/1076-56-0x0000000000840000-0x0000000000858000-memory.dmp
memory/1076-57-0x0000000000730000-0x000000000073C000-memory.dmp
memory/1076-58-0x0000000000AB0000-0x0000000000B3E000-memory.dmp
memory/1076-59-0x0000000004EA0000-0x0000000004ED4000-memory.dmp
memory/1752-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1752-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1752-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1752-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1752-67-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1752-68-0x00000000008F0000-0x0000000000BF3000-memory.dmp