Analysis
- max time kernel
120s - max time network
123s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
- submitted
03/08/2023, 03:28
General
- Target SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe
- Size 886KB
- Sample230803-d1b4caba75
- SHA256 fb6d0c9f8246ae9fafae10a3ed496220f6b2803e454a1da51f07a6dcda5df7b4
Malware Config
Extracted
-
formbook
-
4.1
-
fg01
-
kohzyzb.xyz
-
freehdonlineporn.xyz
-
fitflextr.com
-
jinxiu3.top
-
malditabelleza.online
-
shopfloraflair.com
-
dohrolling.com
-
newadvice4u.com
-
beerexperiment.com
-
kppjmmrp.cfd
-
precinctautomotors.com
-
energia-online.net
-
mountaingoodnessrewards.site
-
ibexpertmasterkey.com
-
rzunirnk.cfd
-
mblhzbno.cfd
-
n-g.vip
-
mintakacom.store
-
fnpdhhdx.cfd
-
zenfulgoods.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2012-59-0x00000000003E0000-0x00000000003EA000-memory.dmp
memory/2012-60-0x00000000061A0000-0x0000000006212000-memory.dmp
memory/2012-55-0x00000000021E0000-0x0000000002220000-memory.dmp
memory/2012-56-0x00000000003D0000-0x00000000003E0000-memory.dmp
memory/2012-57-0x00000000740E0000-0x00000000747CE000-memory.dmp
memory/2012-58-0x00000000021E0000-0x0000000002220000-memory.dmp
memory/2012-54-0x0000000000A50000-0x0000000000B34000-memory.dmp
memory/2012-68-0x00000000740E0000-0x00000000747CE000-memory.dmp
memory/2012-53-0x00000000740E0000-0x00000000747CE000-memory.dmp
memory/2556-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2556-67-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2556-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2556-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2556-69-0x0000000000B40000-0x0000000000E43000-memory.dmp
memory/2556-70-0x0000000000B40000-0x0000000000E43000-memory.dmp