Analysis
- max time kernel
41s - max time network
49s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/07/2024, 12:49
General
- Target f3b25ff7dc9cfcab029413dbaab77efdb5017d72ff5c0cc4d88769de1def78a6.exe
- Size 659KB
- Sample240703-p2bprawcpa
- SHA256 f3b25ff7dc9cfcab029413dbaab77efdb5017d72ff5c0cc4d88769de1def78a6
Malware Config
Extracted
-
formbook
-
4.1
-
cn26
-
ajtsistemas.com
-
kolotylo.info
-
mraofficial.store
-
shopcupsareus.com
-
odishastatenews.in
-
yipicircle.life
-
bryve.shop
-
tempotrekstore.com
-
casinoslotsjoint.com
-
xiaoshuoxyz.com
-
art-birdsflyinghigh.com
-
odvip438.com
-
verlatservicios.com
-
bilocoin.world
-
lamaisonfacile.com
-
guojiang-v37.xyz
-
shsredgpoufnds.net
-
thequorumcompany.com
-
qf4h1tcpmgxor7b.skin
-
daisyjoanniezu.cyou
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3b25ff7dc9cfcab029413dbaab77efdb5017d72ff5c0cc4d88769de1def78a6.exe"C:\Users\Admin\AppData\Local\Temp\f3b25ff7dc9cfcab029413dbaab77efdb5017d72ff5c0cc4d88769de1def78a6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f3b25ff7dc9cfcab029413dbaab77efdb5017d72ff5c0cc4d88769de1def78a6.exe"C:\Users\Admin\AppData\Local\Temp\f3b25ff7dc9cfcab029413dbaab77efdb5017d72ff5c0cc4d88769de1def78a6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/760-6-0x00000000054B0000-0x00000000054D0000-memory.dmp
memory/760-13-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/760-2-0x0000000005500000-0x0000000005AA4000-memory.dmp
memory/760-3-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/760-4-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/760-5-0x0000000004E80000-0x0000000004E8A000-memory.dmp
memory/760-8-0x0000000006520000-0x0000000006536000-memory.dmp
memory/760-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp
memory/760-1-0x00000000003E0000-0x0000000000488000-memory.dmp
memory/760-9-0x0000000006800000-0x0000000006876000-memory.dmp
memory/760-10-0x0000000008E60000-0x0000000008EFC000-memory.dmp
memory/760-7-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4600-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4600-14-0x00000000013B0000-0x00000000016FA000-memory.dmp