Analysis
- max time kernel
46s - max time network
48s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
24/10/2022, 04:27
General
- Target SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe
- Size 796KB
- Sample221024-e234wsefan
- SHA256 c047cf74954804ee634d33f96d2922e9a2bf94ad58c89775b132901810fd1dde
Malware Config
Extracted
-
formbook
-
4.1
-
ndgi
-
vuicotvxrejp3il.xyz
-
w3fa6.net
-
sappuno02.com
-
konstruksirumah.xyz
-
usalifehealth.com
-
and1f.xyz
-
atenmentfstinfdow.beauty
-
primepipe.net
-
roundhouseny.com
-
alexandermcqueen.icu
-
transporteavalos.com
-
spankmetaverse.xyz
-
jhccowholesale.com
-
bielefeldgebaeudereinigung.com
-
saintraphaelschool.com
-
larifaa.online
-
dejabrew.info
-
izabelaeraphael.com
-
granniestoneet.com
-
greensourceseed.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1748-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1748-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1748-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1748-65-0x0000000000870000-0x0000000000B73000-memory.dmp
memory/2012-54-0x0000000010E10000-0x0000000010EDA000-memory.dmp
memory/2012-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
memory/2012-56-0x0000000000380000-0x0000000000396000-memory.dmp
memory/2012-57-0x0000000000430000-0x000000000043C000-memory.dmp
memory/2012-58-0x0000000005CA0000-0x0000000005D10000-memory.dmp
memory/2012-59-0x0000000001F30000-0x0000000001F64000-memory.dmp