Analysis
- max time kernel
87s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
- submitted
19/04/2023, 16:51
General
- Target daf8173675eb174a782edcbbf805b285.exe
- Size 698KB
- Sample230419-vctrxsea3z
- SHA256 3b86e5743a7a35e6c3e1dc7cb1a844299e7b1f9eeea5bb7e51ca0de52b808803
Malware Config
Extracted
-
formbook
-
4.1
-
s17b
-
adriannavasquez.com
-
ticketstolisbon.com
-
hygrostar.com
-
dcairandheat.com
-
gamerviet.com
-
cjdao.net
-
informationdata65319.com
-
ethdefi.live
-
0241d.com
-
bestwoodtoy.com
-
bookingmello.com
-
hjd3c5.com
-
1eisdhiookd.xyz
-
urbanfarmingdynamics.africa
-
graphicsxperts.com
-
ebndeoo.store
-
chenzhenstorea.club
-
brain-life-imaging.info
-
containsmilk.com
-
ebaepay.click
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\daf8173675eb174a782edcbbf805b285.exe"C:\Users\Admin\AppData\Local\Temp\daf8173675eb174a782edcbbf805b285.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\daf8173675eb174a782edcbbf805b285.exe"C:\Users\Admin\AppData\Local\Temp\daf8173675eb174a782edcbbf805b285.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\daf8173675eb174a782edcbbf805b285.exe"C:\Users\Admin\AppData\Local\Temp\daf8173675eb174a782edcbbf805b285.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1052-133-0x0000000000EF0000-0x0000000000FA4000-memory.dmp
memory/1052-134-0x0000000005D90000-0x0000000006334000-memory.dmp
memory/1052-135-0x0000000005880000-0x0000000005912000-memory.dmp
memory/1052-136-0x0000000005820000-0x000000000582A000-memory.dmp
memory/1052-137-0x0000000005AA0000-0x0000000005AB0000-memory.dmp
memory/1052-138-0x0000000005AA0000-0x0000000005AB0000-memory.dmp
memory/1052-139-0x0000000007180000-0x000000000721C000-memory.dmp
memory/4856-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4856-142-0x00000000019F0000-0x0000000001D3A000-memory.dmp