Analysis
- max time kernel
118s - max time network
121s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
- submitted
10/08/2023, 16:51
General
- Target b56ce6c54428054e755a2e56f6cf009c.exe
- Size 610KB
- Sample230810-vctrxsha41
- SHA256 bbd52311d6f6fcc5e1c1296fb53932cac1445ed4d3fe3872a2a8de1f83bd1bf0
Malware Config
Extracted
-
formbook
-
4.1
-
ge83
-
zqgf529.com
-
ohrana-truda-truda-rf.online
-
alyasra-sa.com
-
luxurynev.com
-
glassfactorycaribe.com
-
computechitsolutions.info
-
chillbeathk.com
-
fxphones.com
-
glamvoyager.com
-
empresaspiana.com
-
doraemon.center
-
jobstora.xyz
-
clicasaqui.com
-
shopchanticleers.com
-
xrworldnft.xyz
-
xrtrump.com
-
nirapottabd.com
-
azino777-600.buzz
-
2223malcolm.com
-
darunfayxaklf.vip
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1988-60-0x0000000000360000-0x000000000036E000-memory.dmp
memory/1988-61-0x0000000004490000-0x00000000044FE000-memory.dmp
memory/1988-56-0x0000000005030000-0x0000000005070000-memory.dmp
memory/1988-57-0x0000000000340000-0x0000000000358000-memory.dmp
memory/1988-58-0x00000000744C0000-0x0000000074BAE000-memory.dmp
memory/1988-59-0x0000000005030000-0x0000000005070000-memory.dmp
memory/1988-55-0x00000000744C0000-0x0000000074BAE000-memory.dmp
memory/1988-69-0x00000000744C0000-0x0000000074BAE000-memory.dmp
memory/1988-54-0x0000000000DE0000-0x0000000000E7E000-memory.dmp
memory/2876-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2876-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2876-68-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2876-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2876-70-0x00000000009C0000-0x0000000000CC3000-memory.dmp
memory/2876-71-0x00000000009C0000-0x0000000000CC3000-memory.dmp