Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
01/06/2024, 03:06
General
- Target ca285d2b340f7cdc2b495675775d0769decadda571c3858201d9ee44298ede3e.exe
- Size 2.7MB
- Sample240601-dlsgsagd55
- SHA256 ca285d2b340f7cdc2b495675775d0769decadda571c3858201d9ee44298ede3e
Malware Config
Extracted
-
formbook
-
4.1
-
fa27
-
allconseil.com
-
3-k.top
-
practical-prototyping.com
-
kipoxz.xyz
-
dental-implants-66586.bond
-
cyphernft.com
-
nicolemariani.com
-
suacuasattannoi.com
-
2023woaidianying8.com
-
ballerhaul.com
-
pintobeansnutrition.com
-
shelving-solution.com
-
reuralnenworknou.net
-
childrenscottageschool.com
-
tekkist.com
-
dogostrength.com
-
phoenixstudy.net
-
emoxos.top
-
8898892dh1.online
-
esounsoaps.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca285d2b340f7cdc2b495675775d0769decadda571c3858201d9ee44298ede3e.exe"C:\Users\Admin\AppData\Local\Temp\ca285d2b340f7cdc2b495675775d0769decadda571c3858201d9ee44298ede3e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca285d2b340f7cdc2b495675775d0769decadda571c3858201d9ee44298ede3e.exe"C:\Users\Admin\AppData\Local\Temp\ca285d2b340f7cdc2b495675775d0769decadda571c3858201d9ee44298ede3e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2496-4899-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2496-4902-0x00000000017B0000-0x0000000001AFA000-memory.dmp
memory/2496-4901-0x00000000017B0000-0x0000000001AFA000-memory.dmp
memory/4868-13-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-27-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-17-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-19-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-23-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-47-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-41-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-39-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-37-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-35-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-33-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-31-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-29-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-59-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-43-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-5-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-25-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-21-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-9-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-7-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-15-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-0-0x000000007529E000-0x000000007529F000-memory.dmp
memory/4868-4-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-11-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-45-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-67-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-65-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-63-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-61-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-57-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-55-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-53-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-51-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-49-0x0000000005CC0000-0x0000000005EF8000-memory.dmp
memory/4868-4890-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/4868-4891-0x0000000006020000-0x000000000609A000-memory.dmp
memory/4868-4892-0x0000000005FC0000-0x000000000600C000-memory.dmp
memory/4868-4893-0x000000007529E000-0x000000007529F000-memory.dmp
memory/4868-4894-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/4868-4895-0x0000000006A10000-0x0000000006FB4000-memory.dmp
memory/4868-4896-0x00000000062D0000-0x0000000006324000-memory.dmp
memory/4868-4900-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/4868-3-0x0000000005CC0000-0x0000000005EFE000-memory.dmp
memory/4868-2-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/4868-1-0x0000000000F20000-0x00000000011E2000-memory.dmp