Analysis
- max time kernel
89s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
27/01/2023, 16:55
General
- Target 0c6f648fa11ad1a76e3dbfd5247781eb.exe
- Size 726KB
- Sample230127-ve4pxacb92
- SHA256 d22aed126e64e2ca691c2b8779d7e18f557de18757ba56e265608890960cd09e
Malware Config
Extracted
-
formbook
-
4.1
-
pe63
-
iparkshonan.com
-
cahoonset.com
-
chuliji.com
-
judiangka.boats
-
casadecanyonlane.com
-
hukaol.xyz
-
websiteclonescripts.com
-
jjlpoi.com
-
e-insurance.africa
-
buketubalonu.com
-
foruminati.se
-
12rivalo.xyz
-
bblifebizsolutions.com
-
larimarfitness.com
-
conectado.xyz
-
511271.com
-
shpte-energy.net
-
thewayit.net
-
jpdentistry.co.uk
-
aisini5201314.love
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c6f648fa11ad1a76e3dbfd5247781eb.exe"C:\Users\Admin\AppData\Local\Temp\0c6f648fa11ad1a76e3dbfd5247781eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0c6f648fa11ad1a76e3dbfd5247781eb.exe"C:\Users\Admin\AppData\Local\Temp\0c6f648fa11ad1a76e3dbfd5247781eb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4468-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4468-139-0x0000000001820000-0x0000000001B6A000-memory.dmp
memory/4688-132-0x0000000000420000-0x00000000004DC000-memory.dmp
memory/4688-133-0x0000000005470000-0x0000000005A14000-memory.dmp
memory/4688-134-0x0000000004EC0000-0x0000000004F52000-memory.dmp
memory/4688-135-0x0000000004E90000-0x0000000004E9A000-memory.dmp
memory/4688-136-0x0000000005A20000-0x0000000005ABC000-memory.dmp