Analysis
- max time kernel
90s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
27/01/2023, 16:54
General
- Target 004343f0250f145403696f153c3af750.exe
- Size 704KB
- Sample230127-vejpqsdf3t
- SHA256 8dbb132dccc8fb8a83062fec3840b1556a75862c07d22a0740ca095698ed0f6d
Malware Config
Extracted
-
formbook
-
4.1
-
pe63
-
iparkshonan.com
-
cahoonset.com
-
chuliji.com
-
judiangka.boats
-
casadecanyonlane.com
-
hukaol.xyz
-
websiteclonescripts.com
-
jjlpoi.com
-
e-insurance.africa
-
buketubalonu.com
-
foruminati.se
-
12rivalo.xyz
-
bblifebizsolutions.com
-
larimarfitness.com
-
conectado.xyz
-
511271.com
-
shpte-energy.net
-
thewayit.net
-
jpdentistry.co.uk
-
aisini5201314.love
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"C:\Users\Admin\AppData\Local\Temp\004343f0250f145403696f153c3af750.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2548-132-0x00000000004D0000-0x0000000000586000-memory.dmp
memory/2548-133-0x00000000053C0000-0x0000000005964000-memory.dmp
memory/2548-134-0x0000000004EB0000-0x0000000004F42000-memory.dmp
memory/2548-135-0x0000000004DE0000-0x0000000004DEA000-memory.dmp
memory/2548-136-0x0000000008840000-0x00000000088DC000-memory.dmp
memory/3760-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3760-140-0x00000000016D0000-0x0000000001A1A000-memory.dmp