Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
06/07/2023, 11:55
General
- Target 8eb7939848c171ebb4a2203ad90741bcdc5c7e1feebdd3cd1b7ca4bd4dc307ed.exe
- Size 806KB
- Sample230706-n3fjnaaf23
- SHA256 8eb7939848c171ebb4a2203ad90741bcdc5c7e1feebdd3cd1b7ca4bd4dc307ed
Malware Config
Extracted
-
formbook
-
4.1
-
ee2q
-
uspbs.top
-
proflidi.com
-
fcsawftffcoffical.buzz
-
rustie.link
-
mflol.uk
-
safepalercclaim.buzz
-
tuomamoban.com
-
gxkchp.live
-
kfpu.store
-
bjcxks.com
-
netfiix-account.info
-
flyonex.com
-
faranstechtalk.com
-
littlenuggetproperties.com
-
greatpromo.site
-
bricepacific.com
-
yourhometownappliancerepair.com
-
citrixsettlement.com
-
delivery-broccar.com
-
inncur.space
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb7939848c171ebb4a2203ad90741bcdc5c7e1feebdd3cd1b7ca4bd4dc307ed.exe"C:\Users\Admin\AppData\Local\Temp\8eb7939848c171ebb4a2203ad90741bcdc5c7e1feebdd3cd1b7ca4bd4dc307ed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8eb7939848c171ebb4a2203ad90741bcdc5c7e1feebdd3cd1b7ca4bd4dc307ed.exe"C:\Users\Admin\AppData\Local\Temp\8eb7939848c171ebb4a2203ad90741bcdc5c7e1feebdd3cd1b7ca4bd4dc307ed.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2032-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2032-142-0x00000000015C0000-0x000000000190A000-memory.dmp
memory/3316-133-0x0000000000680000-0x000000000074E000-memory.dmp
memory/3316-134-0x0000000005760000-0x0000000005D04000-memory.dmp
memory/3316-135-0x00000000050E0000-0x0000000005172000-memory.dmp
memory/3316-136-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/3316-137-0x0000000005190000-0x000000000519A000-memory.dmp
memory/3316-138-0x0000000005390000-0x000000000542C000-memory.dmp
memory/3316-139-0x0000000005290000-0x00000000052A0000-memory.dmp