Analysis
- max time kernel
55s - max time network
56s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
29/04/2024, 01:06
General
- Target 13e8e9cf97e4d1357797ef4253db3c784ef8dbf39725214f1b174991c0e1ae4d.exe
- Size 641KB
- Sample240429-bglgkaea71
- SHA256 13e8e9cf97e4d1357797ef4253db3c784ef8dbf39725214f1b174991c0e1ae4d
Malware Config
Extracted
-
formbook
-
4.1
-
be03
-
458q14v4ams2.com
-
priceoctopus.com
-
betinplay.xyz
-
bcnd.xyz
-
1510soliveavenue.com
-
mcdpropertypros.com
-
reddcrownexpress.com
-
rewardlabs.shop
-
burenbrand.com
-
revand.io
-
tractionendurancecoaching.com
-
jotaerreshopp.com
-
shopboyg.com
-
dakor.shop
-
groundswellmag.life
-
nehagadodia.com
-
dancarellibizbroker.com
-
meconline.co
-
ttmq.cc
-
thegoldenyouph.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13e8e9cf97e4d1357797ef4253db3c784ef8dbf39725214f1b174991c0e1ae4d.exe"C:\Users\Admin\AppData\Local\Temp\13e8e9cf97e4d1357797ef4253db3c784ef8dbf39725214f1b174991c0e1ae4d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13e8e9cf97e4d1357797ef4253db3c784ef8dbf39725214f1b174991c0e1ae4d.exe"C:\Users\Admin\AppData\Local\Temp\13e8e9cf97e4d1357797ef4253db3c784ef8dbf39725214f1b174991c0e1ae4d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1036-10-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1036-14-0x00000000016D0000-0x0000000001A1A000-memory.dmp
memory/1036-13-0x00000000016D0000-0x0000000001A1A000-memory.dmp
memory/3960-6-0x0000000005C30000-0x0000000005C50000-memory.dmp
memory/3960-4-0x0000000005840000-0x0000000005850000-memory.dmp
memory/3960-5-0x0000000005970000-0x000000000597A000-memory.dmp
memory/3960-0-0x0000000000E20000-0x0000000000EC2000-memory.dmp
memory/3960-7-0x0000000006A30000-0x0000000006A44000-memory.dmp
memory/3960-8-0x00000000093C0000-0x0000000009436000-memory.dmp
memory/3960-9-0x000000000C4E0000-0x000000000C57C000-memory.dmp
memory/3960-3-0x00000000058B0000-0x0000000005942000-memory.dmp
memory/3960-12-0x0000000074440000-0x0000000074BF0000-memory.dmp
memory/3960-2-0x0000000005D80000-0x0000000006324000-memory.dmp
memory/3960-1-0x0000000074440000-0x0000000074BF0000-memory.dmp