Analysis
- max time kernel
141s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
10/08/2023, 16:51
General
- Target b56ce6c54428054e755a2e56f6cf009c.exe
- Size 610KB
- Sample230810-vctrxsha41
- SHA256 bbd52311d6f6fcc5e1c1296fb53932cac1445ed4d3fe3872a2a8de1f83bd1bf0
Malware Config
Extracted
-
formbook
-
4.1
-
ge83
-
zqgf529.com
-
ohrana-truda-truda-rf.online
-
alyasra-sa.com
-
luxurynev.com
-
glassfactorycaribe.com
-
computechitsolutions.info
-
chillbeathk.com
-
fxphones.com
-
glamvoyager.com
-
empresaspiana.com
-
doraemon.center
-
jobstora.xyz
-
clicasaqui.com
-
shopchanticleers.com
-
xrworldnft.xyz
-
xrtrump.com
-
nirapottabd.com
-
azino777-600.buzz
-
2223malcolm.com
-
darunfayxaklf.vip
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"C:\Users\Admin\AppData\Local\Temp\b56ce6c54428054e755a2e56f6cf009c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1920-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1920-144-0x0000000001380000-0x00000000016CA000-memory.dmp
memory/4576-133-0x0000000000080000-0x000000000011E000-memory.dmp
memory/4576-134-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/4576-135-0x0000000004E70000-0x0000000005414000-memory.dmp
memory/4576-136-0x00000000049C0000-0x0000000004A52000-memory.dmp
memory/4576-137-0x0000000004B60000-0x0000000004B70000-memory.dmp
memory/4576-138-0x0000000004B80000-0x0000000004B8A000-memory.dmp
memory/4576-139-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/4576-140-0x0000000007FA0000-0x000000000803C000-memory.dmp
memory/4576-143-0x0000000075290000-0x0000000075A40000-memory.dmp