Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
07/06/2023, 09:47
General
-
Target
SVD002837727.exe
-
Size
798KB
-
MD5
fdb52da6cf766fb4f0c56d3dac749faa
-
SHA1
32c1e7f2ac0506025ceafd8465fb5be2c61590bf
-
SHA256
6504563c0b530d8886ebe893983491e046949b70117d41c9baff7e8503e202dd
-
SHA512
a9aa3ad596173825499b88c3abf07ace7f407ffa90a0dce4c631ac3e8b0dd278f3a3be198a05726c0ca914474845efc249a6fb6482b11e4a03f89b67d10e4bd9
-
SSDEEP
12288:6ZyvbhaDnLMzIL2q+RTdOL8er5TXnrd2Bh5qj4lPucRd3nX88+c7vWbtNr9/2DIY:3OyqGUL8CTXSPuc7Xs7J/y2B/S
Malware Config
Extracted
formbook
4.1
km37
busybody.app
damcostafreda12.cat
blueridgebedracks.com
hilltopspice.com
addonysfitwear.com
bestridelabs.com
huashi366.com
1wihug.top
66563.se
96mvipmy.com
lab1207.com
80b80.app
graphicstudio53.com
xn--etherealsoires-mkb.com
bestrosetoy.com
discounthub.xyz
addmusthaveoppprofit.online
abovegame.biz
getv3apparel.com
designroom.app
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SVD002837727.exe"C:\Users\Admin\AppData\Local\Temp\SVD002837727.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SVD002837727.exe"C:\Users\Admin\AppData\Local\Temp\SVD002837727.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SVD002837727.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
80KB
-
Filesize
588KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
976KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
816KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
624KB