Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
10/01/2025, 14:08
General
- Target 2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe
- Size 675KB
- Sample250110-rfkrmswmcv
- SHA256 2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42
Malware Config
Extracted
-
formbook
-
4.1
-
m25s
-
araghospitality.net
-
cleans.xyz
-
olnacasinotcs14.top
-
pringhillinfos.net
-
erkakasrumah.online
-
orean-course-289113002.zone
-
yeloma-treatment-82106.bond
-
76iw543gw.autos
-
nline-shopping-56055.bond
-
enetik.xyz
-
ax-th-6011838.fyi
-
itygatehousing.app
-
23zy998jk.bond
-
pslag-hal-2.online
-
uykoii.shop
-
9supjub3p.buzz
-
tmgl.bond
-
actus-catering-creations.net
-
ntercashspace24.homes
-
ierra777.vip
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe"C:\Users\Admin\AppData\Local\Temp\2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe"C:\Users\Admin\AppData\Local\Temp\2d1500188097d6bc8f6bcd1690db485ea07e82470b2a631246a4ff5c4b64fa42.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2788-6-0x0000000005210000-0x0000000005222000-memory.dmp
memory/2788-13-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2788-2-0x0000000005580000-0x0000000005B24000-memory.dmp
memory/2788-3-0x0000000005080000-0x0000000005112000-memory.dmp
memory/2788-4-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2788-5-0x0000000005140000-0x000000000514A000-memory.dmp
memory/2788-8-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2788-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp
memory/2788-1-0x0000000000600000-0x00000000006AE000-memory.dmp
memory/2788-9-0x00000000083C0000-0x0000000008436000-memory.dmp
memory/2788-10-0x000000000AB70000-0x000000000AC0C000-memory.dmp
memory/2788-7-0x0000000074D0E000-0x0000000074D0F000-memory.dmp
memory/3592-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3592-14-0x0000000001300000-0x000000000164A000-memory.dmp