Analysis
- max time kernel
94s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
03/12/2024, 14:25
General
- Target 03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe
- Size 658KB
- Sample241203-rrbm4svjer
- SHA256 03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6
Malware Config
Extracted
-
formbook
-
4.1
-
fh84
-
mtzyn.top
-
zfn-no-hsts.win
-
j10g.xyz
-
arehouse-inventory-60572.bond
-
nlineprodutooffer.shop
-
ar-deals-77764.bond
-
e3m2.xyz
-
cquisitive.group
-
unkusol.xyz
-
01307.xyz
-
uratedcelebrations.net
-
nfiniworkshop-thai.online
-
s-cmc.net
-
idney360.info
-
ipolar-treatment-us-311-ze.zone
-
entenstituleridernegi.biz
-
olombiaoutlet.shop
-
uradab.rest
-
qega.shop
-
73519.vip
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe"C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe"C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe"C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4252-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4252-14-0x00000000016A0000-0x00000000019EA000-memory.dmp
memory/5096-6-0x0000000074F7E000-0x0000000074F7F000-memory.dmp
memory/5096-3-0x0000000004CB0000-0x0000000004D42000-memory.dmp
memory/5096-4-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/5096-5-0x0000000004D80000-0x0000000004D8A000-memory.dmp
memory/5096-0-0x0000000074F7E000-0x0000000074F7F000-memory.dmp
memory/5096-7-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/5096-8-0x00000000050B0000-0x00000000050C2000-memory.dmp
memory/5096-9-0x0000000007880000-0x00000000078F6000-memory.dmp
memory/5096-10-0x000000000A010000-0x000000000A0AC000-memory.dmp
memory/5096-2-0x0000000005260000-0x0000000005804000-memory.dmp
memory/5096-13-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/5096-1-0x0000000000280000-0x000000000032A000-memory.dmp