Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
04/12/2023, 04:39
General
- Target SecuriteInfo.com.Win32.PWSX-gen.10739.14206.exe
- Size 661KB
- Sample231204-e9yt5sha3s
- SHA256 2a0883f81fa813b247ae1243050bc720926599286a213725a86a50ced42c0ead
Malware Config
Extracted
-
formbook
-
4.1
-
he2a
-
connectioncompass.store
-
zekicharge.com
-
dp77.shop
-
guninfo.guru
-
mamaeconomics.net
-
narcisme.coach
-
redtopassociates.com
-
ezezn.com
-
theoregondog.com
-
pagosmultired.online
-
emsculptcenterofne.com
-
meet-friends.online
-
pf326.com
-
wealthjigsaw.xyz
-
arsajib.com
-
kickassholdings.online
-
avaturre.biz
-
dtslogs.com
-
lb92.tech
-
pittalam.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10739.14206.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10739.14206.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10739.14206.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.10739.14206.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/852-8-0x0000000005D50000-0x0000000005D5A000-memory.dmp
memory/852-9-0x0000000005C20000-0x0000000005C30000-memory.dmp
memory/852-2-0x0000000005C20000-0x0000000005C30000-memory.dmp
memory/852-3-0x00000000061E0000-0x0000000006784000-memory.dmp
memory/852-4-0x0000000005C30000-0x0000000005CC2000-memory.dmp
memory/852-5-0x0000000005CF0000-0x0000000005CFA000-memory.dmp
memory/852-0-0x0000000000FC0000-0x000000000106A000-memory.dmp
memory/852-6-0x0000000005D00000-0x0000000005D18000-memory.dmp
memory/852-1-0x00000000753A0000-0x0000000075B50000-memory.dmp
memory/852-7-0x0000000005D40000-0x0000000005D48000-memory.dmp
memory/852-10-0x0000000006F00000-0x0000000006F6E000-memory.dmp
memory/852-11-0x0000000006D30000-0x0000000006DCC000-memory.dmp
memory/852-15-0x00000000753A0000-0x0000000075B50000-memory.dmp
memory/852-14-0x00000000753A0000-0x0000000075B50000-memory.dmp
memory/4752-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4752-16-0x0000000001940000-0x0000000001C8A000-memory.dmp