Analysis
- max time kernel
140s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
03/08/2023, 03:28
General
- Target SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe
- Size 886KB
- Sample230803-d1b4caba75
- SHA256 fb6d0c9f8246ae9fafae10a3ed496220f6b2803e454a1da51f07a6dcda5df7b4
Malware Config
Extracted
-
formbook
-
4.1
-
fg01
-
kohzyzb.xyz
-
freehdonlineporn.xyz
-
fitflextr.com
-
jinxiu3.top
-
malditabelleza.online
-
shopfloraflair.com
-
dohrolling.com
-
newadvice4u.com
-
beerexperiment.com
-
kppjmmrp.cfd
-
precinctautomotors.com
-
energia-online.net
-
mountaingoodnessrewards.site
-
ibexpertmasterkey.com
-
rzunirnk.cfd
-
mblhzbno.cfd
-
n-g.vip
-
mintakacom.store
-
fnpdhhdx.cfd
-
zenfulgoods.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.9919.8426.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/448-142-0x0000000000400000-0x000000000042F000-memory.dmp
memory/448-145-0x0000000000FB0000-0x00000000012FA000-memory.dmp
memory/3312-133-0x00000000746F0000-0x0000000074EA0000-memory.dmp
memory/3312-134-0x0000000000A10000-0x0000000000AF4000-memory.dmp
memory/3312-135-0x0000000005A30000-0x0000000005FD4000-memory.dmp
memory/3312-136-0x0000000005520000-0x00000000055B2000-memory.dmp
memory/3312-137-0x0000000005700000-0x0000000005710000-memory.dmp
memory/3312-138-0x00000000054D0000-0x00000000054DA000-memory.dmp
memory/3312-139-0x0000000005800000-0x000000000589C000-memory.dmp
memory/3312-140-0x00000000746F0000-0x0000000074EA0000-memory.dmp
memory/3312-141-0x0000000005700000-0x0000000005710000-memory.dmp
memory/3312-144-0x00000000746F0000-0x0000000074EA0000-memory.dmp