Analysis
- max time kernel
66s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
29/04/2024, 01:26
General
- Target 864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17.exe
- Size 778KB
- Sample240429-bth7zaeb59
- SHA256 864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17
Malware Config
Extracted
-
formbook
-
4.1
-
be03
-
458q14v4ams2.com
-
priceoctopus.com
-
betinplay.xyz
-
bcnd.xyz
-
1510soliveavenue.com
-
mcdpropertypros.com
-
reddcrownexpress.com
-
rewardlabs.shop
-
burenbrand.com
-
revand.io
-
tractionendurancecoaching.com
-
jotaerreshopp.com
-
shopboyg.com
-
dakor.shop
-
groundswellmag.life
-
nehagadodia.com
-
dancarellibizbroker.com
-
meconline.co
-
ttmq.cc
-
thegoldenyouph.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17.exe"C:\Users\Admin\AppData\Local\Temp\864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17.exe"C:\Users\Admin\AppData\Local\Temp\864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1760-6-0x0000000005450000-0x0000000005470000-memory.dmp
memory/1760-1-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/1760-2-0x00000000057E0000-0x0000000005D84000-memory.dmp
memory/1760-3-0x0000000005230000-0x00000000052C2000-memory.dmp
memory/1760-4-0x0000000005480000-0x0000000005490000-memory.dmp
memory/1760-5-0x0000000005210000-0x000000000521A000-memory.dmp
memory/1760-0-0x0000000000760000-0x0000000000824000-memory.dmp
memory/1760-7-0x0000000005630000-0x0000000005644000-memory.dmp
memory/1760-8-0x00000000090A0000-0x0000000009116000-memory.dmp
memory/1760-9-0x000000000C1B0000-0x000000000C24C000-memory.dmp
memory/1760-12-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/3664-10-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3664-13-0x0000000001440000-0x000000000178A000-memory.dmp