Analysis
- max time kernel
90s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
18/10/2022, 10:33
General
- Target IMG20221018-56789098765560890.exe
- Size 1.0MB
- Sample221018-mlhr1sfffl
- SHA256 49139beffbec5c8b7f4f11e82112e0972f60de6b7064456b1cec936d5dd20cec
Malware Config
Extracted
-
formbook
-
s5zx
-
wMAY83Xf8pYlwmcLm5HvBdaL
-
CEtcpyGISM/CVFQ5zam3
-
jQE/nMmnXlmcTVQ5zam3
-
kUtRVpN/YY33wLfac81TKg==
-
WxtrRs8s52o/GPsPog==
-
w8LUN0UWABcTD1Hv
-
pCU+Wnk+6/E08im2Xo5y7uea
-
4o2dnKCJNOgbwud9JfMHrMJuAGI+fg==
-
AbPNtFXXpcoeyWB1WGC/AOiS
-
5Kbo75EKwcLiArHSoc/SIg==
-
IaICXWtqc2xvU++OXEd+tRitdw==
-
x0M6GKkDC8SPQGd/S61UdfgVZLqVDFg=
-
Y6TEJKsC3IxVJN986uJugqNcN7NO5EU=
-
rltiOepgaw3Mk0Lbt1yoxuA=
-
z94mjMxyFcLUu1Q=
-
xH3F3Hz93BCSMuBtI65JGm+VN3xm
-
+GO142npuuptGPsPog==
-
WX/VsE7R0FTm3Ju2ema/AOiS
-
qam0OKkfCyE6ZKxZtQ==
-
0ojGr0OMV9khz+4GoA==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"C:\Users\Admin\AppData\Local\Temp\IMG20221018-56789098765560890.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2132-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2132-142-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2132-143-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2132-144-0x0000000001210000-0x000000000155A000-memory.dmp
memory/4804-132-0x00000000000A0000-0x00000000001AC000-memory.dmp
memory/4804-133-0x0000000004FF0000-0x0000000005594000-memory.dmp
memory/4804-134-0x0000000004B40000-0x0000000004BD2000-memory.dmp
memory/4804-135-0x0000000004BF0000-0x0000000004BFA000-memory.dmp
memory/4804-136-0x000000000B680000-0x000000000B71C000-memory.dmp
memory/4804-137-0x000000000B720000-0x000000000B786000-memory.dmp