Analysis
- max time kernel
93s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
06/07/2024, 01:01
General
- Target 0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe
- Size 684KB
- Sample240706-bdl9patcrd
- SHA256 0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd
Malware Config
Extracted
-
formbook
-
4.1
-
mc10
-
sttcorp.one
-
jack88.lat
-
owl-protect.com
-
hnszrrn.com
-
at89v2.com
-
h147.top
-
takle4creators.com
-
fondsa.xyz
-
mantenopolice.com
-
shophansler.com
-
dessertt.com
-
thecollisionmagazine.com
-
tatesfluffyfrenchies.com
-
h1f2v.rest
-
bluewandltd.com
-
cuplaho2003.shop
-
2thetcleaningservice.com
-
yc85w.top
-
natursache.shop
-
allmyabilities.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"C:\Users\Admin\AppData\Local\Temp\0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4384-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4384-14-0x0000000001350000-0x000000000169A000-memory.dmp
memory/5080-6-0x0000000006820000-0x00000000068CE000-memory.dmp
memory/5080-3-0x0000000005660000-0x00000000056F2000-memory.dmp
memory/5080-4-0x0000000005650000-0x000000000565A000-memory.dmp
memory/5080-5-0x0000000074580000-0x0000000074D30000-memory.dmp
memory/5080-0-0x000000007458E000-0x000000007458F000-memory.dmp
memory/5080-7-0x00000000068D0000-0x00000000068EA000-memory.dmp
memory/5080-8-0x0000000006A50000-0x0000000006A58000-memory.dmp
memory/5080-9-0x0000000006A60000-0x0000000006A6C000-memory.dmp
memory/5080-10-0x000000000D670000-0x000000000D6E6000-memory.dmp
memory/5080-11-0x0000000010E40000-0x0000000010EDC000-memory.dmp
memory/5080-2-0x0000000005B70000-0x0000000006114000-memory.dmp
memory/5080-1-0x0000000000B80000-0x0000000000C32000-memory.dmp
memory/5080-15-0x0000000074580000-0x0000000074D30000-memory.dmp