Analysis
- max time kernel
91s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
04/06/2024, 01:38
General
- Target 8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4.exe
- Size 651KB
- Sample240604-b2cp6agg8w
- SHA256 8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4
Malware Config
Extracted
-
formbook
-
4.1
-
cn26
-
ajtsistemas.com
-
kolotylo.info
-
mraofficial.store
-
shopcupsareus.com
-
odishastatenews.in
-
yipicircle.life
-
bryve.shop
-
tempotrekstore.com
-
casinoslotsjoint.com
-
xiaoshuoxyz.com
-
art-birdsflyinghigh.com
-
odvip438.com
-
verlatservicios.com
-
bilocoin.world
-
lamaisonfacile.com
-
guojiang-v37.xyz
-
shsredgpoufnds.net
-
thequorumcompany.com
-
qf4h1tcpmgxor7b.skin
-
daisyjoanniezu.cyou
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Detects executables packed with SmartAssembly 1 IoCs
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4.exe"C:\Users\Admin\AppData\Local\Temp\8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4.exe"C:\Users\Admin\AppData\Local\Temp\8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2912-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2912-15-0x0000000000ED0000-0x000000000121A000-memory.dmp
memory/2912-14-0x0000000000ED0000-0x000000000121A000-memory.dmp
memory/3880-6-0x0000000005890000-0x00000000058AE000-memory.dmp
memory/3880-5-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/3880-4-0x0000000005220000-0x000000000522A000-memory.dmp
memory/3880-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp
memory/3880-7-0x0000000006390000-0x00000000063A0000-memory.dmp
memory/3880-8-0x00000000064D0000-0x00000000064E6000-memory.dmp
memory/3880-9-0x0000000006C70000-0x0000000006CE6000-memory.dmp
memory/3880-10-0x00000000092C0000-0x000000000935C000-memory.dmp
memory/3880-3-0x0000000005270000-0x0000000005302000-memory.dmp
memory/3880-13-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/3880-2-0x00000000058D0000-0x0000000005E74000-memory.dmp
memory/3880-1-0x0000000000770000-0x0000000000816000-memory.dmp