Analysis
- max time kernel
125s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
22/11/2023, 07:17
General
- Target SecuriteInfo.com.Win32.PWSX-gen.14716.17790.exe
- Size 538KB
- Sample231122-h4c72aah63
- SHA256 baa2e4bc9527c3b121f69e7d581344f27b3b8cfbb867857e5d2c8e7b6e6d03af
Malware Config
Extracted
-
formbook
-
4.1
-
vl53
-
bushypussypi.com
-
alzentori.com
-
pearlmassagecentre.com
-
zag6.com
-
workadumail.com
-
ferreelectricosdaniel.com
-
takethislolypopo.com
-
maylanicornier.com
-
nptstudio.com
-
dunasgolf.com
-
guangshangjituan.com
-
cj6p.lat
-
camloi.xyz
-
goldcoastkayakfishing.com
-
hiasannatal.site
-
safesnipper.com
-
adamssecurities.com
-
productizewithmalu.com
-
oral-nursing.online
-
adultproducts.top
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.14716.17790.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.14716.17790.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.14716.17790.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.14716.17790.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2236-6-0x00000000054B0000-0x000000000554C000-memory.dmp
memory/2236-10-0x00000000065B0000-0x000000000661E000-memory.dmp
memory/2236-2-0x0000000005800000-0x0000000005DA4000-memory.dmp
memory/2236-3-0x0000000005250000-0x00000000052E2000-memory.dmp
memory/2236-4-0x0000000005400000-0x0000000005410000-memory.dmp
memory/2236-5-0x00000000053E0000-0x00000000053EA000-memory.dmp
memory/2236-1-0x0000000000820000-0x00000000008AC000-memory.dmp
memory/2236-8-0x0000000005710000-0x0000000005718000-memory.dmp
memory/2236-0-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/2236-9-0x0000000005720000-0x000000000572A000-memory.dmp
memory/2236-7-0x00000000056E0000-0x00000000056F2000-memory.dmp
memory/2236-14-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/2236-13-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/2540-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2540-15-0x0000000001380000-0x00000000016CA000-memory.dmp