Analysis
- max time kernel
88s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
24/10/2022, 04:27
General
- Target SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe
- Size 796KB
- Sample221024-e234wsefan
- SHA256 c047cf74954804ee634d33f96d2922e9a2bf94ad58c89775b132901810fd1dde
Malware Config
Extracted
-
formbook
-
4.1
-
ndgi
-
vuicotvxrejp3il.xyz
-
w3fa6.net
-
sappuno02.com
-
konstruksirumah.xyz
-
usalifehealth.com
-
and1f.xyz
-
atenmentfstinfdow.beauty
-
primepipe.net
-
roundhouseny.com
-
alexandermcqueen.icu
-
transporteavalos.com
-
spankmetaverse.xyz
-
jhccowholesale.com
-
bielefeldgebaeudereinigung.com
-
saintraphaelschool.com
-
larifaa.online
-
dejabrew.info
-
izabelaeraphael.com
-
granniestoneet.com
-
greensourceseed.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10656.24668.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1224-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1224-140-0x0000000001900000-0x0000000001C4A000-memory.dmp
memory/3876-132-0x0000000000520000-0x00000000005EA000-memory.dmp
memory/3876-133-0x0000000005570000-0x0000000005B14000-memory.dmp
memory/3876-134-0x0000000004FC0000-0x0000000005052000-memory.dmp
memory/3876-135-0x0000000004F90000-0x0000000004F9A000-memory.dmp
memory/3876-136-0x0000000008A40000-0x0000000008ADC000-memory.dmp