Analysis
- max time kernel
135s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:52
General
- Target eff8d83878a21a67564864f6a4da8f66.exe
- Size 563KB
- Sample201109-akhera67q6
- SHA256 568a6bfbf5ce68d84fba719dcbee920751fb52b24890c6a9f6258aa670026d07
Score
10/10
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.howndey.com/xd4/
Decoy
-
agimbahtiri.com
-
equostore.com
-
crazyisrelative.com
-
twins-mom.com
-
getawaygoat.com
-
assert.ltd
-
futuretehran.com
-
83300298.com
-
viaffic.com
-
977ck.com
-
0pe641.com
-
capakinfluble.com
-
2e51bf.top
-
amafilms.com
-
umbrellafit.com
-
jpennercorp.info
-
kyrarose.com
-
capitanesdelacalle.com
-
eypf84wqst.biz
-
theeugenenyc.us
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eff8d83878a21a67564864f6a4da8f66.exe"C:\Users\Admin\AppData\Local\Temp\eff8d83878a21a67564864f6a4da8f66.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cuQvVYA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA677.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\eff8d83878a21a67564864f6a4da8f66.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\eff8d83878a21a67564864f6a4da8f66.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3024-2-0x0000000000400000-0x000000000042A000-memory.dmp