Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
29-12-2024 09:41
General
-
Target
LPO NO - 19615.exe
-
Size
252KB
-
MD5
bc2c939dc95ccb7c1ab6b593c5e7fc36
-
SHA1
077fa9ad551e0f3eeab0807fdc090e1d7c8484dd
-
SHA256
915861e0bf6cb3a567b8ce22c1ab89626d9f1ab175cd8bb4eab4d8232cc2b880
-
SHA512
5c55ec7670fa61d314c9202a0a244c05a4e94f36c6a0ae8097b89693b5c49e2d8bf4faa1fa0dc3dd4fa721b88ac2f549735d7b38d17881217d6de5b28c0977a4
-
SSDEEP
6144:pb3/W+HZZn3rbykHzxjjlZoXDfVh+pehqyu50+zOzR+3OfK2:pbO+5Z36kNHobj+LDLzOw3OfK
Malware Config
Extracted
formbook
4.1
fn02
wkinforresearch.com
hnfsclw.com
flow2live.com
2bveruyucdxnerf2.com
art-istratova.online
day2plus.net
finovatio.com
50706.net
theabotanicalsph.com
longcovid.run
semperempoweringequity.com
consumerismbarbarica.com
rightloaddispatching.com
tansonews.com
emakz-nih.com
dbluxurycarrentals.com
streetfood-real.store
fagamotorsperu.com
consortiumwatches.com
intodialog.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
-
Formbook payload 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LPO NO - 19615.exe"C:\Users\Admin\AppData\Local\Temp\LPO NO - 19615.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
272KB
-
Filesize
368KB
-
Filesize
288KB
-
Filesize
9.9MB
-
Filesize
9.9MB