Analysis
- max time kernel
49s - max time network
33s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
28/04/2023, 11:10
General
- Target bc278e61afe6b7ec94d465d01bb603c3.exe
- Size 657KB
- Sample230428-m9qsjade86
- SHA256 9d1779f9a627d5d1cd19c2a1f74f71eddb92cc11d8757d4ea3a2e7b315f4186d
Malware Config
Extracted
-
formbook
-
4.1
-
e8fg
-
rmaex.xyz
-
thegreenambition.com
-
ifmcustomerevents.com
-
agencewebimage.com
-
w0a00dbe.buzz
-
shopbequynhff.com
-
webpetarung.online
-
girlgonecyber.com
-
lexoutwest.com
-
gramshilpartandcraft.com
-
kemeioficial.com
-
track-race-package.com
-
shop-domanopro.com
-
bohanshow.com
-
ateliermedispa.com
-
paragonhonda-ny.com
-
calzadosnova.com
-
thephoenixoneproject.com
-
pl66380.com
-
nightowlmarketinggroup.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1484-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1484-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1484-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1484-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1484-65-0x0000000000A20000-0x0000000000D23000-memory.dmp
memory/2016-54-0x0000000000D70000-0x0000000000E1A000-memory.dmp
memory/2016-55-0x0000000004ED0000-0x0000000004F10000-memory.dmp
memory/2016-56-0x0000000000460000-0x0000000000476000-memory.dmp
memory/2016-57-0x0000000004ED0000-0x0000000004F10000-memory.dmp
memory/2016-58-0x0000000000560000-0x000000000056C000-memory.dmp
memory/2016-59-0x0000000005E20000-0x0000000005E90000-memory.dmp
memory/2016-60-0x0000000000BE0000-0x0000000000C18000-memory.dmp