Analysis
- max time kernel
135s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
28/04/2023, 11:10
General
- Target bc278e61afe6b7ec94d465d01bb603c3.exe
- Size 657KB
- Sample230428-m9qsjade86
- SHA256 9d1779f9a627d5d1cd19c2a1f74f71eddb92cc11d8757d4ea3a2e7b315f4186d
Malware Config
Extracted
-
formbook
-
4.1
-
e8fg
-
rmaex.xyz
-
thegreenambition.com
-
ifmcustomerevents.com
-
agencewebimage.com
-
w0a00dbe.buzz
-
shopbequynhff.com
-
webpetarung.online
-
girlgonecyber.com
-
lexoutwest.com
-
gramshilpartandcraft.com
-
kemeioficial.com
-
track-race-package.com
-
shop-domanopro.com
-
bohanshow.com
-
ateliermedispa.com
-
paragonhonda-ny.com
-
calzadosnova.com
-
thephoenixoneproject.com
-
pl66380.com
-
nightowlmarketinggroup.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"C:\Users\Admin\AppData\Local\Temp\bc278e61afe6b7ec94d465d01bb603c3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4392-133-0x0000000000BE0000-0x0000000000C8A000-memory.dmp
memory/4392-134-0x0000000005B60000-0x0000000006104000-memory.dmp
memory/4392-135-0x0000000005650000-0x00000000056E2000-memory.dmp
memory/4392-136-0x0000000005800000-0x000000000580A000-memory.dmp
memory/4392-137-0x0000000005630000-0x0000000005640000-memory.dmp
memory/4392-138-0x0000000005630000-0x0000000005640000-memory.dmp
memory/4392-139-0x000000000AF30000-0x000000000AFCC000-memory.dmp
memory/5024-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/5024-142-0x00000000011F0000-0x000000000153A000-memory.dmp