Analysis
- max time kernel
42s - max time network
34s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
27/01/2023, 16:54
General
- Target 004343f0250f145403696f153c3af750.exe
- Size 704KB
- Sample230127-vejpqsdf3t
- SHA256 8dbb132dccc8fb8a83062fec3840b1556a75862c07d22a0740ca095698ed0f6d
Malware Config
Extracted
-
formbook
-
4.1
-
pe63
-
iparkshonan.com
-
cahoonset.com
-
chuliji.com
-
judiangka.boats
-
casadecanyonlane.com
-
hukaol.xyz
-
websiteclonescripts.com
-
jjlpoi.com
-
e-insurance.africa
-
buketubalonu.com
-
foruminati.se
-
12rivalo.xyz
-
bblifebizsolutions.com
-
larimarfitness.com
-
conectado.xyz
-
511271.com
-
shpte-energy.net
-
thewayit.net
-
jpdentistry.co.uk
-
aisini5201314.love
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/896-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/896-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/896-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/896-65-0x0000000000A10000-0x0000000000D13000-memory.dmp
memory/956-54-0x00000000002E0000-0x0000000000396000-memory.dmp
memory/956-55-0x0000000075891000-0x0000000075893000-memory.dmp
memory/956-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/956-57-0x0000000000430000-0x000000000043A000-memory.dmp
memory/956-58-0x0000000004F70000-0x0000000004FE0000-memory.dmp
memory/956-59-0x00000000021A0000-0x00000000021D6000-memory.dmp