Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
11/07/2023, 06:35
General
- Target SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe
- Size 326KB
- Sample230711-hcbvwsff8y
- SHA256 6e5b648d1e574dfbbd6337c6d11b851b2b12efec1f0ae59b1327e0dce1dfe7e6
Malware Config
Extracted
-
formbook
-
4.1
-
a0a2
-
littleconcernsociety.com
-
baigaoedu.com
-
jatpoloclub.com
-
luiwox.xyz
-
bearardath.com
-
infoversilia.com
-
ot-to-j.com
-
sable40k.com
-
whatravthinks.com
-
angelnajeraperez.com
-
juegosfriv2019com.com
-
i205towing.com
-
shmyhzd.com
-
dayschevorlet.com
-
ingnance.com
-
melaniemetheny.com
-
bigmatcarex.com
-
mbdgiftgallery.com
-
livesolerev.com
-
swimsuitlageprijs.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2576-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2576-142-0x00000000019B0000-0x0000000001CFA000-memory.dmp
memory/4988-133-0x0000000000820000-0x0000000000878000-memory.dmp
memory/4988-134-0x0000000004B50000-0x0000000004BEC000-memory.dmp
memory/4988-135-0x0000000004B20000-0x0000000004B30000-memory.dmp
memory/4988-136-0x000000000A470000-0x000000000AA14000-memory.dmp
memory/4988-137-0x0000000009FA0000-0x000000000A032000-memory.dmp
memory/4988-138-0x0000000005950000-0x000000000595A000-memory.dmp
memory/4988-139-0x0000000004B20000-0x0000000004B30000-memory.dmp