Analysis
- max time kernel
141s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231025-en - resource tags
- submitted
27/11/2023, 02:55
General
- Target SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe
- Size 559KB
- Sample231127-defveadh82
- SHA256 5d4ef95e2d68ad71b54c79a6a8fcfdee4d64ac4187e30a9b8523e0dc6cdedd10
Malware Config
Extracted
-
formbook
-
4.1
-
vl53
-
bushypussypi.com
-
alzentori.com
-
pearlmassagecentre.com
-
zag6.com
-
workadumail.com
-
ferreelectricosdaniel.com
-
takethislolypopo.com
-
maylanicornier.com
-
nptstudio.com
-
dunasgolf.com
-
guangshangjituan.com
-
cj6p.lat
-
camloi.xyz
-
goldcoastkayakfishing.com
-
hiasannatal.site
-
safesnipper.com
-
adamssecurities.com
-
productizewithmalu.com
-
oral-nursing.online
-
adultproducts.top
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1556-6-0x00000000062E0000-0x00000000062F8000-memory.dmp
memory/1556-10-0x0000000006B20000-0x0000000006BBC000-memory.dmp
memory/1556-2-0x0000000005420000-0x00000000059C4000-memory.dmp
memory/1556-3-0x0000000004F10000-0x0000000004FA2000-memory.dmp
memory/1556-4-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/1556-5-0x0000000004EE0000-0x0000000004EEA000-memory.dmp
memory/1556-1-0x00000000752C0000-0x0000000075A70000-memory.dmp
memory/1556-8-0x0000000006480000-0x000000000648A000-memory.dmp
memory/1556-0-0x0000000000480000-0x0000000000512000-memory.dmp
memory/1556-9-0x0000000006A10000-0x0000000006A7E000-memory.dmp
memory/1556-7-0x0000000006470000-0x0000000006476000-memory.dmp
memory/1556-13-0x00000000752C0000-0x0000000075A70000-memory.dmp
memory/4996-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4996-14-0x0000000001120000-0x000000000146A000-memory.dmp
memory/4996-15-0x0000000001120000-0x000000000146A000-memory.dmp