Analysis
- max time kernel
49s - max time network
31s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
22/04/2023, 10:59
General
- Target 3340686730dd1fa9f3fa44c38ac8d224.exe
- Size 633KB
- Sample230422-m3d56aee35
- SHA256 a83adc88feb896f4fa1b09b3d5043fd506f9de5f6d695f7e18bb3d84019abb85
Malware Config
Extracted
-
formbook
-
4.1
-
gtt8
-
thesuccessbot.com
-
rittercivil.com
-
jt1.fun
-
d365extension.com
-
quqoxeq.top
-
visittworiverswi.com
-
bfprotienda.com
-
greenhabitsph.com
-
ladmere.com
-
clockboutiques.com
-
minwart.xyz
-
xinyuejiancai.online
-
eggsl.com
-
fetchingcandles.com
-
skywatiniya.com
-
hinkley.news
-
realityonlineenterprises.com
-
teamcroissant.com
-
esfera-pv.ch
-
herdadedosmontesbastos.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3340686730dd1fa9f3fa44c38ac8d224.exe"C:\Users\Admin\AppData\Local\Temp\3340686730dd1fa9f3fa44c38ac8d224.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3340686730dd1fa9f3fa44c38ac8d224.exe"C:\Users\Admin\AppData\Local\Temp\3340686730dd1fa9f3fa44c38ac8d224.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1980-54-0x0000000001070000-0x0000000001114000-memory.dmp
memory/1980-55-0x0000000004D80000-0x0000000004DC0000-memory.dmp
memory/1980-56-0x00000000003D0000-0x00000000003E2000-memory.dmp
memory/1980-57-0x0000000004D80000-0x0000000004DC0000-memory.dmp
memory/1980-58-0x0000000000500000-0x000000000050C000-memory.dmp
memory/1980-59-0x00000000051E0000-0x0000000005250000-memory.dmp
memory/1980-60-0x00000000007F0000-0x0000000000828000-memory.dmp
memory/2004-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2004-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2004-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2004-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2004-65-0x00000000008D0000-0x0000000000BD3000-memory.dmp