Analysis
- max time kernel
143s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
14/08/2023, 04:29
General
- Target SecuriteInfo.com.Win32.PWSX-gen.4301.26196.exe
- Size 587KB
- Sample230814-e382jabd6y
- SHA256 73cb9c68b47d45884c4cbdb18d45a63a4d67a1f22ab8cb2a6ec92423cd77948d
Malware Config
Extracted
-
formbook
-
4.1
-
d6dt
-
curenveda.com
-
mavilitur.xyz
-
airdropfisher.com
-
jxwqeumw.click
-
solepowertool.com
-
quickmartltd.com
-
postbh.com
-
aerialcarried.click
-
teamabr-rfa.com
-
jeagma9k.click
-
aquaafiafoodsafety.com
-
dangtutu.com
-
lahfhg.com
-
patricia-lee.com
-
nextgencoders.tech
-
scercommerce.online
-
crates.surf
-
casamorganagelatos.com
-
dwynet.com
-
3genenterprisesllc.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.4301.26196.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.4301.26196.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.4301.26196.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.4301.26196.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3164-133-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/3164-134-0x0000000000D30000-0x0000000000DCA000-memory.dmp
memory/3164-135-0x0000000005D90000-0x0000000006334000-memory.dmp
memory/3164-136-0x00000000057E0000-0x0000000005872000-memory.dmp
memory/3164-137-0x0000000005780000-0x0000000005790000-memory.dmp
memory/3164-138-0x0000000005770000-0x000000000577A000-memory.dmp
memory/3164-139-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/3164-140-0x0000000005780000-0x0000000005790000-memory.dmp
memory/3164-141-0x0000000009920000-0x00000000099BC000-memory.dmp
memory/3164-144-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/4976-142-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4976-145-0x0000000001510000-0x000000000185A000-memory.dmp