Analysis
- max time kernel
146s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
12/10/2023, 13:05
General
- Target 47ea784b5aa582da550a12add7ccd74d.exe
- Size 588KB
- Sample231012-qbhk2sdb76
- SHA256 e3adb8e74cd21839185ef70b6430c229a34636536412afc08bfbf1b8a610b359
Malware Config
Extracted
-
formbook
-
4.1
-
o5gu
-
jonathanvuportfolio.website
-
moneyboost.net
-
imikecutyou.com
-
toollessassembling.com
-
keoinfra.com
-
mackenziejamesphoto.com
-
zenovaa.com
-
ngmnetwork.com
-
odropoficial.com
-
huyangli.company
-
ganjajuice.info
-
promptmechanic.xyz
-
crispyjoy.com
-
dinevintageshirts.com
-
heyxop.online
-
hopefinancialmarketingph.com
-
weeklyvolcano.app
-
consultoriopmn.com
-
seetheratequote.com
-
ftds77.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47ea784b5aa582da550a12add7ccd74d.exe"C:\Users\Admin\AppData\Local\Temp\47ea784b5aa582da550a12add7ccd74d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\47ea784b5aa582da550a12add7ccd74d.exe"C:\Users\Admin\AppData\Local\Temp\47ea784b5aa582da550a12add7ccd74d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/312-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/312-14-0x00000000015C0000-0x000000000190A000-memory.dmp
memory/904-6-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/904-3-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/904-4-0x00000000052E0000-0x0000000005372000-memory.dmp
memory/904-5-0x0000000005560000-0x0000000005570000-memory.dmp
memory/904-0-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/904-7-0x00000000054F0000-0x000000000550A000-memory.dmp
memory/904-8-0x0000000005560000-0x0000000005570000-memory.dmp
memory/904-9-0x0000000000C40000-0x0000000000C4C000-memory.dmp
memory/904-10-0x0000000005760000-0x00000000057CE000-memory.dmp
memory/904-11-0x0000000008770000-0x000000000880C000-memory.dmp
memory/904-2-0x0000000005890000-0x0000000005E34000-memory.dmp
memory/904-1-0x0000000000790000-0x000000000082A000-memory.dmp
memory/904-15-0x00000000743E0000-0x0000000074B90000-memory.dmp