Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
01/05/2024, 01:56
General
- Target c4b6e4bd4131eaa2fba28259570135346ea35a90bf271bab1560f019550698fd.exe
- Size 612KB
- Sample240501-cc4ysafd73
- SHA256 c4b6e4bd4131eaa2fba28259570135346ea35a90bf271bab1560f019550698fd
Malware Config
Extracted
-
formbook
-
4.1
-
be03
-
458q14v4ams2.com
-
priceoctopus.com
-
betinplay.xyz
-
bcnd.xyz
-
1510soliveavenue.com
-
mcdpropertypros.com
-
reddcrownexpress.com
-
rewardlabs.shop
-
burenbrand.com
-
revand.io
-
tractionendurancecoaching.com
-
jotaerreshopp.com
-
shopboyg.com
-
dakor.shop
-
groundswellmag.life
-
nehagadodia.com
-
dancarellibizbroker.com
-
meconline.co
-
ttmq.cc
-
thegoldenyouph.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4b6e4bd4131eaa2fba28259570135346ea35a90bf271bab1560f019550698fd.exe"C:\Users\Admin\AppData\Local\Temp\c4b6e4bd4131eaa2fba28259570135346ea35a90bf271bab1560f019550698fd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4b6e4bd4131eaa2fba28259570135346ea35a90bf271bab1560f019550698fd.exe"C:\Users\Admin\AppData\Local\Temp\c4b6e4bd4131eaa2fba28259570135346ea35a90bf271bab1560f019550698fd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2188-6-0x0000000001050000-0x00000000010C6000-memory.dmp
memory/2188-1-0x0000000074390000-0x0000000074A7E000-memory.dmp
memory/2188-2-0x0000000004EE0000-0x0000000004F20000-memory.dmp
memory/2188-3-0x00000000003F0000-0x0000000000408000-memory.dmp
memory/2188-4-0x0000000000410000-0x000000000041E000-memory.dmp
memory/2188-5-0x0000000000590000-0x00000000005A6000-memory.dmp
memory/2188-0-0x00000000011D0000-0x000000000126C000-memory.dmp
memory/2188-14-0x0000000074390000-0x0000000074A7E000-memory.dmp
memory/2524-7-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2524-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2524-9-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2524-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2524-15-0x0000000000700000-0x0000000000A03000-memory.dmp