Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231025-en - resource tags
- submitted
06/11/2023, 10:24
General
- Target 77d1b390dcc1e2517116ae6db3bf7fa7.exe
- Size 696KB
- Sample231106-mfdk4sae2z
- SHA256 ccbdd15e650bb5d3bb0e22c96cfb7d03b38b1fcbd7f7c161c87726fa04df6570
Malware Config
Extracted
-
formbook
-
4.1
-
o5gu
-
jonathanvuportfolio.website
-
moneyboost.net
-
imikecutyou.com
-
toollessassembling.com
-
keoinfra.com
-
mackenziejamesphoto.com
-
zenovaa.com
-
ngmnetwork.com
-
odropoficial.com
-
huyangli.company
-
ganjajuice.info
-
promptmechanic.xyz
-
crispyjoy.com
-
dinevintageshirts.com
-
heyxop.online
-
hopefinancialmarketingph.com
-
weeklyvolcano.app
-
consultoriopmn.com
-
seetheratequote.com
-
ftds77.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77d1b390dcc1e2517116ae6db3bf7fa7.exe"C:\Users\Admin\AppData\Local\Temp\77d1b390dcc1e2517116ae6db3bf7fa7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77d1b390dcc1e2517116ae6db3bf7fa7.exe"C:\Users\Admin\AppData\Local\Temp\77d1b390dcc1e2517116ae6db3bf7fa7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3712-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3712-17-0x00000000012B0000-0x00000000015FA000-memory.dmp
memory/3712-16-0x00000000012B0000-0x00000000015FA000-memory.dmp
memory/3884-8-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/3884-10-0x00000000066F0000-0x00000000066FA000-memory.dmp
memory/3884-5-0x0000000005230000-0x0000000005240000-memory.dmp
memory/3884-6-0x00000000055C0000-0x00000000055CA000-memory.dmp
memory/3884-7-0x0000000006CF0000-0x0000000006CFE000-memory.dmp
memory/3884-0-0x00000000005D0000-0x0000000000684000-memory.dmp
memory/3884-9-0x0000000005230000-0x0000000005240000-memory.dmp
memory/3884-4-0x0000000005240000-0x0000000005594000-memory.dmp
memory/3884-11-0x0000000006D00000-0x0000000006D86000-memory.dmp
memory/3884-12-0x0000000009390000-0x000000000942C000-memory.dmp
memory/3884-3-0x00000000050E0000-0x0000000005172000-memory.dmp
memory/3884-15-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/3884-2-0x00000000055F0000-0x0000000005B94000-memory.dmp
memory/3884-1-0x0000000074D00000-0x00000000754B0000-memory.dmp