Analysis
- max time kernel
143s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
15/02/2024, 15:35
General
- Target 9deb8fec62787f6a330618dfcb84d818.exe
- Size 677KB
- Sample240215-s1ralaab7x
- SHA256 0f83f86907255eadae1caec99da48bd60689e359e40938f12453dcb3093851ad
Malware Config
Extracted
-
formbook
-
4.1
-
if60
-
dutaaksarawedar.com
-
conflicttech.com
-
growinfant.com
-
desingchiro.com
-
juicykingcrabexpress1111.com
-
christal-capital.com
-
mythicspacex.com
-
eezeecompliance.com
-
smartpro-apps.com
-
foliapaper.com
-
decor-galorec.com
-
wednesdaywinetime.com
-
ecnstore.com
-
icitycompany.com
-
kokaabrows.com
-
edwardmillerplumbing.com
-
nasiratusa.net
-
thaicafeirvine.com
-
serviceinnovation.net
-
freedigilife.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9deb8fec62787f6a330618dfcb84d818.exe"C:\Users\Admin\AppData\Local\Temp\9deb8fec62787f6a330618dfcb84d818.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9deb8fec62787f6a330618dfcb84d818.exe"C:\Users\Admin\AppData\Local\Temp\9deb8fec62787f6a330618dfcb84d818.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2604-8-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/2604-9-0x0000000005260000-0x0000000005270000-memory.dmp
memory/2604-2-0x0000000005850000-0x0000000005DF4000-memory.dmp
memory/2604-3-0x00000000052A0000-0x0000000005332000-memory.dmp
memory/2604-4-0x0000000005260000-0x0000000005270000-memory.dmp
memory/2604-5-0x0000000005200000-0x000000000520A000-memory.dmp
memory/2604-0-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/2604-7-0x00000000055A0000-0x00000000055BC000-memory.dmp
memory/2604-1-0x0000000000760000-0x0000000000810000-memory.dmp
memory/2604-6-0x0000000006910000-0x00000000069AC000-memory.dmp
memory/2604-10-0x0000000006D50000-0x0000000006DBC000-memory.dmp
memory/2604-11-0x0000000009380000-0x00000000093B4000-memory.dmp
memory/2604-14-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/4472-12-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4472-15-0x0000000001A80000-0x0000000001DCA000-memory.dmp
memory/4472-16-0x0000000001A80000-0x0000000001DCA000-memory.dmp