Analysis
- max time kernel
94s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
03/09/2024, 13:46
General
- Target 25e5055023abbb8c18992618b6f04c94b8b13ff8bd33d4a4f8462d92902461bf.exe
- Size 460KB
- Sample240903-q223daybkn
- SHA256 25e5055023abbb8c18992618b6f04c94b8b13ff8bd33d4a4f8462d92902461bf
Malware Config
Extracted
-
formbook
-
4.1
-
cnp0
-
jiarenyuanhunlian.com
-
xquizitelashesnwaxx.com
-
rentinerie.com
-
herbalpedia-id.com
-
openseagames.com
-
re-swap.com
-
william-cook.com
-
segensv.com
-
versebay.com
-
brendanlairdsound.com
-
bypestor.com
-
hospitaldelpc.net
-
wwwroadrunnerfinancial.com
-
waterhammerstudios.com
-
hustleandbank.photography
-
secure01bchslogin.com
-
rarepeperanking.com
-
greatland.company
-
happybirthdayjewel.com
-
raheok.store
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25e5055023abbb8c18992618b6f04c94b8b13ff8bd33d4a4f8462d92902461bf.exe"C:\Users\Admin\AppData\Local\Temp\25e5055023abbb8c18992618b6f04c94b8b13ff8bd33d4a4f8462d92902461bf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\25e5055023abbb8c18992618b6f04c94b8b13ff8bd33d4a4f8462d92902461bf.exe"C:\Users\Admin\AppData\Local\Temp\25e5055023abbb8c18992618b6f04c94b8b13ff8bd33d4a4f8462d92902461bf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2560-6-0x00000000051E0000-0x00000000051EE000-memory.dmp
memory/2560-10-0x0000000006200000-0x0000000006258000-memory.dmp
memory/2560-2-0x00000000057B0000-0x0000000005D54000-memory.dmp
memory/2560-3-0x0000000005200000-0x0000000005292000-memory.dmp
memory/2560-4-0x00000000051B0000-0x00000000051BA000-memory.dmp
memory/2560-5-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/2560-1-0x0000000000740000-0x00000000007BA000-memory.dmp
memory/2560-8-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/2560-0-0x000000007490E000-0x000000007490F000-memory.dmp
memory/2560-9-0x0000000006000000-0x000000000609C000-memory.dmp
memory/2560-7-0x000000007490E000-0x000000007490F000-memory.dmp
memory/2560-13-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/3844-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3844-14-0x0000000001600000-0x000000000194A000-memory.dmp
memory/3844-15-0x0000000001600000-0x000000000194A000-memory.dmp