Analysis
- max time kernel
118s - max time network
125s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
10/01/2025, 14:08
General
- Target 2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe
- Size 675KB
- Sample250110-rfkrmswmcv
- SHA256 2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42
Malware Config
Extracted
-
formbook
-
4.1
-
m25s
-
araghospitality.net
-
cleans.xyz
-
olnacasinotcs14.top
-
pringhillinfos.net
-
erkakasrumah.online
-
orean-course-289113002.zone
-
yeloma-treatment-82106.bond
-
76iw543gw.autos
-
nline-shopping-56055.bond
-
enetik.xyz
-
ax-th-6011838.fyi
-
itygatehousing.app
-
23zy998jk.bond
-
pslag-hal-2.online
-
uykoii.shop
-
9supjub3p.buzz
-
tmgl.bond
-
actus-catering-creations.net
-
ntercashspace24.homes
-
ierra777.vip
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe"C:\Users\Admin\AppData\Local\Temp\2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe"C:\Users\Admin\AppData\Local\Temp\2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1732-15-0x0000000000A40000-0x0000000000D43000-memory.dmp
memory/1732-16-0x0000000000A40000-0x0000000000D43000-memory.dmp
memory/1732-8-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1732-9-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1732-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1732-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2244-3-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2244-6-0x0000000004BC0000-0x0000000004C36000-memory.dmp
memory/2244-14-0x0000000074AC0000-0x00000000751AE000-memory.dmp
memory/2244-5-0x0000000074AC0000-0x00000000751AE000-memory.dmp
memory/2244-4-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
memory/2244-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
memory/2244-2-0x0000000074AC0000-0x00000000751AE000-memory.dmp
memory/2244-1-0x0000000000050000-0x00000000000FE000-memory.dmp