Analysis
- max time kernel
112s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
24/10/2022, 13:15
General
- Target 903445f22b43753564f19b9e748d36bc.exe
- Size 825KB
- Sample221024-qhbfbaghel
- SHA256 401d8ede073c42e3cb7c03934bbbb8b1ace7ae84c88098a680c6cefbaab26cdf
Malware Config
Extracted
-
formbook
-
4.1
-
ni4s
-
3279u.com
-
petuniay.com
-
erinbutelevated.com
-
yikaixiang.com
-
payback-help.com
-
boobiescaps.com
-
seaviewbeachhome.com
-
alvernft.com
-
9912.info
-
albastakistudio.com
-
communitymineralar.com
-
jerinphilip.com
-
sbstrans.net
-
rollinggreencircle.com
-
adcancedbionutritionals.com
-
musa.app
-
ms-zijin.com
-
rumahcahayautama.id
-
delivermelater.com
-
xn--mgb9cblfddr.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\903445f22b43753564f19b9e748d36bc.exe"C:\Users\Admin\AppData\Local\Temp\903445f22b43753564f19b9e748d36bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\903445f22b43753564f19b9e748d36bc.exe"C:\Users\Admin\AppData\Local\Temp\903445f22b43753564f19b9e748d36bc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3120-132-0x0000000000870000-0x0000000000944000-memory.dmp
memory/3120-133-0x00000000057E0000-0x0000000005D84000-memory.dmp
memory/3120-134-0x00000000052F0000-0x0000000005382000-memory.dmp
memory/3120-135-0x0000000005410000-0x000000000541A000-memory.dmp
memory/3120-136-0x0000000008E40000-0x0000000008EDC000-memory.dmp
memory/4276-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4276-139-0x0000000000F30000-0x000000000127A000-memory.dmp