Analysis
- max time kernel
140s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
18/11/2022, 10:59
General
- Target SecuriteInfo.com.Win32.PWSX-gen.25245.27166.exe
- Size 722KB
- Sample221118-m3dvdsdb4v
- SHA256 6b2d71b9e5b1ed1d75d7eb03141735491c906c4e4dc6846bc1ef6e032507b1a5
Malware Config
Extracted
-
formbook
-
qmpa
-
IEiN8oqOnNUEkfZd
-
LWyAr1P5PHPV
-
tMGP9gYCIc9DKQ==
-
fWi2stCh2E3DBWuEK612
-
B3LCCi2JvPxfNA==
-
NjLnNjX+DDWt/VuEK612
-
AvK5/JdMDLztPRg=
-
U+zn2FswDLztPRg=
-
3bRIXGwsIc9DKQ==
-
EXmAoj3/7Cyl+VuEK612
-
1gkKPklP1odxx7c/Zm+L6HeV4g==
-
1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=
-
MSyBdIV+6nFRloTQAwmFklQ=
-
qilszGJvhMUsHgaUx/MNSKuo6A==
-
WYKLwmYEij4q2Hy6sOc=
-
sjII/IyFmORBFPJ2dVjpG0Q=
-
mTjzaRwZ9OsEkfZd
-
iL27vFhbX5ECbBIJxvJKbPHFf9M=
-
5A5Xr0D5PHPV
-
IpxsaTO4a1/I
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25245.27166.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25245.27166.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25245.27166.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25245.27166.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25245.27166.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25245.27166.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3556-139-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3556-141-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3556-142-0x0000000000401000-0x000000000042E000-memory.dmp
memory/3556-143-0x00000000011D0000-0x000000000151A000-memory.dmp
memory/4796-132-0x0000000000020000-0x00000000000DC000-memory.dmp
memory/4796-133-0x0000000004F90000-0x0000000005534000-memory.dmp
memory/4796-134-0x0000000004A80000-0x0000000004B12000-memory.dmp
memory/4796-135-0x0000000004C10000-0x0000000004C1A000-memory.dmp
memory/4796-136-0x00000000086B0000-0x000000000874C000-memory.dmp