Analysis
- max time kernel
55s - max time network
33s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
08/06/2023, 11:58
General
- Target 6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe
- Size 732KB
- Sample230608-n456psfa94
- SHA256 6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f
Malware Config
Extracted
-
formbook
-
4.1
-
ca82
-
idunresearch.com
-
loiioo1.site
-
aimobilify.com
-
limousineswebdesign.com
-
darshan-enterprises.online
-
javad.top
-
dd-spy.com
-
metamysme.co.uk
-
earticlesdirect.com
-
ldkj78v.vip
-
dariusevory.com
-
bestyoutubepromoter.com
-
dogcoinacademy.com
-
mestredosexo.net
-
mrnofree.africa
-
plan.rsvp
-
hoangnam.site
-
cadcamperform.com
-
091888.net
-
artwaylogistics.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe"C:\Users\Admin\AppData\Local\Temp\6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe"C:\Users\Admin\AppData\Local\Temp\6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/684-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/684-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/684-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/684-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/684-64-0x0000000000BE0000-0x0000000000EE3000-memory.dmp
memory/2024-54-0x00000000008A0000-0x000000000095C000-memory.dmp
memory/2024-55-0x0000000000550000-0x0000000000590000-memory.dmp
memory/2024-56-0x00000000002A0000-0x00000000002AE000-memory.dmp
memory/2024-57-0x00000000002B0000-0x00000000002BA000-memory.dmp
memory/2024-58-0x0000000005320000-0x0000000005390000-memory.dmp
memory/2024-59-0x0000000002150000-0x0000000002188000-memory.dmp