Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
09/11/2022, 16:51
General
- Target f5aaeb84ea18e9af249804c9ee505a55.exe
- Size 1022KB
- Sample221109-vctf6acbcp
- SHA256 3c9009eeffcaac6b1e45e26ed3d7c399b42d9a9507cc56ddec477c399a3d9b2f
Malware Config
Extracted
-
formbook
-
4.1
-
ua69
-
uslanmayizz.com
-
rrucrowd.com
-
nerexy.online
-
guolang-clan.com
-
meteleabogados.com
-
sh-gottipati.com
-
themesmiui.com
-
anananlan.com
-
roghanala.com
-
yekitiba.com
-
echoskinco.com
-
btlpour.xyz
-
shoyo-samaa.com
-
fuzzywumpus.net
-
malerzeit.com
-
xiam.online
-
brandibraunalissa.com
-
cryptominis.pro
-
we-living.com
-
dc-invest.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5aaeb84ea18e9af249804c9ee505a55.exe"C:\Users\Admin\AppData\Local\Temp\f5aaeb84ea18e9af249804c9ee505a55.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f5aaeb84ea18e9af249804c9ee505a55.exe"C:\Users\Admin\AppData\Local\Temp\f5aaeb84ea18e9af249804c9ee505a55.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4236-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4236-140-0x0000000001100000-0x000000000144A000-memory.dmp
memory/4904-132-0x0000000000EB0000-0x0000000000FB6000-memory.dmp
memory/4904-133-0x0000000005F20000-0x00000000063EC000-memory.dmp
memory/4904-134-0x00000000059A0000-0x0000000005A32000-memory.dmp
memory/4904-135-0x00000000069A0000-0x0000000006F44000-memory.dmp
memory/4904-136-0x0000000005990000-0x000000000599A000-memory.dmp
memory/4904-137-0x0000000008930000-0x00000000089CC000-memory.dmp