Analysis
- max time kernel
181s - max time network
187s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
22/11/2022, 04:33
General
- Target SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe
- Size 917KB
- Sample221122-e6jaaaad29
- SHA256 c30a52af8e6fdb816ad1efea8ad00af616202cdd9df1fccaa85d744da35f65e1
Malware Config
Extracted
-
formbook
-
cfvc
-
qFcyI8OAPHKap6ubfQ==
-
NuOCNnr/zOqy1xM5AN4=
-
CnHfypZMLKQKgKaaVw4J1g==
-
9WpDFnsiwEyoFko7+GYiyo55
-
zUKhZPi3f21+ux+L
-
vqqeiTTPlz+cnQaD
-
GLGZh9zop+UvsCtBEm9x
-
eCUGyUEAe9hmj8KgaA==
-
EvXUn0s63zJyoxQfCGQmMZRu
-
kVy6iO/FuRGD/A==
-
+tg0M82KQk7fX4XXoYIluHMEFhbrzMk=
-
hP/nqutI9DR+0mBnYA==
-
cwrq1kLJd9QzqtQq9QCc7hHV9FjjKSvU
-
eE6vlcLHxAHZ7g==
-
vpKQL84+30y4SZpU/Ox5
-
vbfnlWZmAj1aVbCdbA==
-
UNQwEfT8tzbiL3J2Wrjm3g==
-
02LLqYRY9SeDIHwK5pFjYrg=
-
PhkLzj8IuT6R7v3lxlBYwqO69HReqnrF
-
mkYwC5lsF6cDS6RU/Ox5
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/216-132-0x00000000009C0000-0x0000000000AAC000-memory.dmp
memory/216-133-0x0000000005A30000-0x0000000005FD4000-memory.dmp
memory/216-134-0x0000000005480000-0x0000000005512000-memory.dmp
memory/216-135-0x0000000005450000-0x000000000545A000-memory.dmp
memory/216-136-0x0000000007C40000-0x0000000007CDC000-memory.dmp
memory/4880-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4880-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4880-142-0x0000000000401000-0x000000000042F000-memory.dmp
memory/4880-143-0x0000000001700000-0x0000000001A4A000-memory.dmp