Analysis
- max time kernel
54s - max time network
69s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
- submitted
22/06/2023, 08:31
General
- Target 223de4efb0c50f487d0bef8adeda7317.exe
- Size 1.2MB
- Sample230622-kep7eadd24
- SHA256 08d32fc257cd9dfd7bac9f1e5fa15776d6842bed5f695a24f7345556af00bd4c
Malware Config
Extracted
-
formbook
-
4.1
-
ns62
-
7.phd
-
jhxcbhjsbs.buzz
-
lehighduplex.com
-
dapurmodifikasi.com
-
jipf3uq.top
-
ruishijd.com
-
hhs1973reunion.com
-
azxteri.xyz
-
liyounengyuan.com
-
wonderexpertise.com
-
thesmokeydungeon.com
-
calmmotion.store
-
liniesspiega.xyz
-
staiccautes.cfd
-
161be4c34847.com
-
c0ffeebit.com
-
h7tfyg53fe.com
-
gs779.vip
-
decorandotufiesta.com
-
greenbottle.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\223de4efb0c50f487d0bef8adeda7317.exe"C:\Users\Admin\AppData\Local\Temp\223de4efb0c50f487d0bef8adeda7317.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\223de4efb0c50f487d0bef8adeda7317.exe"C:\Users\Admin\AppData\Local\Temp\223de4efb0c50f487d0bef8adeda7317.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\223de4efb0c50f487d0bef8adeda7317.exe"C:\Users\Admin\AppData\Local\Temp\223de4efb0c50f487d0bef8adeda7317.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4960-133-0x00000000007C0000-0x0000000000900000-memory.dmp
memory/4960-134-0x0000000005920000-0x0000000005EC4000-memory.dmp
memory/4960-135-0x00000000052A0000-0x0000000005332000-memory.dmp
memory/4960-136-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/4960-137-0x0000000005350000-0x000000000535A000-memory.dmp
memory/4960-138-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/4960-139-0x0000000006FA0000-0x000000000703C000-memory.dmp
memory/4968-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4968-142-0x0000000001A40000-0x0000000001D8A000-memory.dmp