Analysis
- max time kernel
142s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
04/10/2023, 00:32
General
- Target SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.2531.21348.exe
- Size 768KB
- Sample231004-avmfcaaa72
- SHA256 b835220d18074195e2df569e8088470b7f400c334aef1dd54dfe30e2019dab7a
Malware Config
Extracted
-
formbook
-
4.1
-
ge58
-
squibbs10year.com
-
merchallqualitystorecenter.com
-
avylw.com
-
chubbysamericangrill.com
-
passionforfashionbyshivani.com
-
bergfors.email
-
hearing-tests-30868.bond
-
seattleaminals.net
-
gbxibeb.com
-
mhbalancenow.com
-
goliathhomesgroup.com
-
paradigmayazilim.com
-
esgaspol.com
-
qzoneqyt.shop
-
aieibook.com
-
best-rudderstack.life
-
cpd888.com
-
231564515.top
-
fairytailfigures.online
-
smartmarketadmin.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.2531.21348.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.2531.21348.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.2531.21348.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.2531.21348.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1968-9-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1968-12-0x00000000014F0000-0x000000000183A000-memory.dmp
memory/2700-0-0x0000000000880000-0x0000000000946000-memory.dmp
memory/2700-1-0x0000000074990000-0x0000000075140000-memory.dmp
memory/2700-2-0x0000000005230000-0x0000000005240000-memory.dmp
memory/2700-3-0x0000000005200000-0x0000000005208000-memory.dmp
memory/2700-4-0x00000000066A0000-0x00000000066FE000-memory.dmp
memory/2700-5-0x0000000006720000-0x000000000676E000-memory.dmp
memory/2700-6-0x0000000006780000-0x00000000067CC000-memory.dmp
memory/2700-7-0x0000000006DD0000-0x0000000007374000-memory.dmp
memory/2700-11-0x0000000074990000-0x0000000075140000-memory.dmp