Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/04/2024, 07:51
General
- Target Transport-Label-9336773773773737.scr.exe
- Size 688KB
- Sample240408-jpwaqscc64
- SHA256 0a88a2e3cd7e300b0d55966ff1b19c3643739dd1bdeaada05f9e7f8841557202
Malware Config
Extracted
-
formbook
-
4.1
-
tt15
-
wholeplant.online
-
pornimmersive.site
-
gelcreativecollabs.com
-
novanewsbrasil.com
-
prefabhomes2024th.space
-
stelautosrl.online
-
wellnessmindfulhealth.com
-
qhgly.lol
-
thefutureshub.com
-
compk5l.info
-
insurance-offers.com
-
de-solarroof.today
-
pn-pasarwajo.com
-
rachelelice.com
-
inkninsight.com
-
innoviewclinical.com
-
austrofoods.com
-
mayanlanguagesaccess.co
-
ablaiserver.com
-
staffcanteencook200.buzz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transport-Label-9336773773773737.scr.exe"C:\Users\Admin\AppData\Local\Temp\Transport-Label-9336773773773737.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Transport-Label-9336773773773737.scr.exe"C:\Users\Admin\AppData\Local\Temp\Transport-Label-9336773773773737.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Transport-Label-9336773773773737.scr.exe"C:\Users\Admin\AppData\Local\Temp\Transport-Label-9336773773773737.scr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1416-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1416-14-0x00000000012C0000-0x000000000160A000-memory.dmp
memory/4048-6-0x0000000005460000-0x00000000054FC000-memory.dmp
memory/4048-3-0x00000000051E0000-0x0000000005272000-memory.dmp
memory/4048-4-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4048-5-0x0000000005150000-0x000000000515A000-memory.dmp
memory/4048-0-0x00000000007E0000-0x000000000088E000-memory.dmp
memory/4048-7-0x0000000005370000-0x000000000538C000-memory.dmp
memory/4048-8-0x00000000053A0000-0x00000000053A8000-memory.dmp
memory/4048-9-0x0000000002B70000-0x0000000002B7C000-memory.dmp
memory/4048-10-0x0000000006030000-0x00000000060A6000-memory.dmp
memory/4048-2-0x00000000056F0000-0x0000000005C94000-memory.dmp
memory/4048-13-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/4048-1-0x0000000074650000-0x0000000074E00000-memory.dmp