Overview

overview

10

Static

static

1

SecuriteIn...80.exe

windows7_x64

10

SecuriteIn...80.exe

windows10_x64

10

Analysis

  • max time kernel
    7s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    06-05-2021 16:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Gen.Variant.Jaik.45760.22297.11380.exe

  • Size

    226KB

  • MD5

    7b4973aec7a63ca2903b317601acbd10

  • SHA1

    342038824bb18ecc6c4a1097d62755bd06ef4969

  • SHA256

    49418af33201289e66136b482386db29a68e32c689f0b625eed3699b8bb45940

  • SHA512

    386a1f9ed6e79f6af9931ae16f96a3e810b1ce94722d88b742a861561f9a5540290c205bc4168603048cfa696b86f21b6fe46d95530d6f6acac0bfacf1247355

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.knighttechinca.com/dxe/

Decoy

sardarfarm.com

959tremont.com

privat-livecam.net

ansel-homebakery.com

joysupermarket.com

peninsulamatchmakers.net

northsytyle.com

radioconexaoubermusic.com

relocatingrealtor.com

desyrnan.com

onlinehoortoestel.online

enpointe.online

rvvikings.com

paulpoirier.com

shitarpa.net

kerneis.net

rokitreach.com

essentiallygaia.com

prestiged.net

fuerzaagavera.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 1 IoCs
    rat
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Jaik.45760.22297.11380.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Jaik.45760.22297.11380.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Jaik.45760.22297.11380.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Jaik.45760.22297.11380.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nss8CE5.tmp\3pguwjx5frsgv1i.dll
    MD5

    3d9d6e6ac1aa74a9f893d791c7119b68

    SHA1

    1040ff294f2e65b5cecf7bb7651011c1a1b65891

    SHA256

    f5706588a7904db84355bd99792765e174a216a0479daa9d44a7d49f56c516fa

    SHA512

    c55cd85e246fd6d48e3fa31ed7e4ddbd587dc0dce3353c26e01c19823adfe418dfab34f99b9de793088d8c446187f21c04fc84c099de6c52d9df0aaa93d93bb3

    Download Submit
  • memory/1088-60-0x0000000075DA1000-0x0000000075DA3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1088-62-0x0000000000340000-0x0000000000342000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1492-63-0x000000000041EAF0-mapping.dmp
    Download
  • memory/1492-64-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

    Download
  • memory/1492-65-0x00000000006E0000-0x00000000009E3000-memory.dmp
    Filesize

    3.0MB

    Download