Analysis
- max time kernel
130s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
11/10/2023, 14:03
General
- Target CH2023-EGR012-60_61_62_63_64.exe
- Size 853KB
- Sample231011-rc5yeadf67
- SHA256 ae5f1fa9855fd6e4511a674f0a0465df7960a757409a0d176f50b10fd14925ad
Malware Config
Extracted
-
formbook
-
4.1
-
sn26
-
resenha10.bet
-
gulshan-rajput.com
-
xbus.tech
-
z813my.cfd
-
wlxzjlny.cfd
-
auntengotiempo.com
-
canada-reservation.com
-
thegiftcompany.shop
-
esthersilveirapropiedades.com
-
1wapws.top
-
ymjblnvo.cfd
-
termokimik.net
-
kushiro-artist-school.com
-
bmmboo.com
-
caceresconstructionservices.com
-
kentuckywalkabout.com
-
bringyourcart.com
-
miamiwinetour.com
-
bobcatsocial.site
-
thirdmind.network
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CH2023-EGR012-60_61_62_63_64.exe"C:\Users\Admin\AppData\Local\Temp\CH2023-EGR012-60_61_62_63_64.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CH2023-EGR012-60_61_62_63_64.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2036-8-0x0000000008270000-0x00000000085C4000-memory.dmp
memory/2036-9-0x0000000007CB0000-0x0000000007CBC000-memory.dmp
memory/2036-2-0x0000000007670000-0x000000000770C000-memory.dmp
memory/2036-3-0x0000000007CC0000-0x0000000008264000-memory.dmp
memory/2036-4-0x00000000077B0000-0x0000000007842000-memory.dmp
memory/2036-5-0x00000000079B0000-0x00000000079C0000-memory.dmp
memory/2036-6-0x0000000007770000-0x000000000777A000-memory.dmp
memory/2036-7-0x00000000079C0000-0x0000000007A16000-memory.dmp
memory/2036-1-0x0000000000730000-0x000000000080A000-memory.dmp
memory/2036-10-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/2036-0-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/2036-11-0x00000000079B0000-0x00000000079C0000-memory.dmp
memory/2036-12-0x00000000094E0000-0x0000000009566000-memory.dmp
memory/2036-13-0x0000000002AB0000-0x0000000002AE4000-memory.dmp
memory/2036-16-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/2256-14-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2256-17-0x0000000001A50000-0x0000000001D9A000-memory.dmp