Analysis
- max time kernel
143s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
23/10/2023, 17:21
General
- Target NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
- Size 589KB
- Sample231023-vxcddabc7t
- SHA256 760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139
Malware Config
Extracted
-
formbook
-
4.1
-
ls02
-
vocabularybot.com
-
invisalignsmilesolutions.xyz
-
sleepdisorderinsomnia.com
-
bern.beauty
-
ahazmcdris.top
-
21874960sie8ca1.store
-
yeitced.xyz
-
biggerpictureventures.com
-
alduhagroup.com
-
itsolutions.biz
-
0oq6y.com
-
wildpolis.com
-
mariobet469.com
-
brynnwpods.com
-
tastywin.com
-
cou2m1.com
-
newaitrucks.com
-
puremeans.studio
-
mitienda-la.com
-
jujuresorthotel.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2088-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2088-15-0x0000000001510000-0x000000000185A000-memory.dmp
memory/5100-6-0x0000000005D30000-0x0000000005DCC000-memory.dmp
memory/5100-3-0x0000000005A10000-0x0000000005AA2000-memory.dmp
memory/5100-4-0x0000000005BE0000-0x0000000005BF0000-memory.dmp
memory/5100-5-0x0000000005BB0000-0x0000000005BBA000-memory.dmp
memory/5100-0-0x0000000074F40000-0x00000000756F0000-memory.dmp
memory/5100-7-0x0000000007430000-0x0000000007448000-memory.dmp
memory/5100-8-0x0000000074F40000-0x00000000756F0000-memory.dmp
memory/5100-9-0x0000000005BE0000-0x0000000005BF0000-memory.dmp
memory/5100-10-0x0000000006FB0000-0x0000000006FC0000-memory.dmp
memory/5100-11-0x0000000007620000-0x000000000768E000-memory.dmp
memory/5100-2-0x0000000005EE0000-0x0000000006484000-memory.dmp
memory/5100-14-0x0000000074F40000-0x00000000756F0000-memory.dmp
memory/5100-1-0x0000000000F90000-0x0000000001028000-memory.dmp