Analysis
- max time kernel
146s - max time network
147s - platform
windows10_x64 - resource
win10v20210410 - submitted
31/05/2021, 10:47
General
- Target 43bc92909f85f8597f8bc5b573438615.exe
- Size 236KB
- Sample210531-matg3ebywe
- SHA256 b8b841d90fe179b235744659d1bf9cd9860ff6d081b25ef0d485beefcf59e28a
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
C2
-
http://www.personalizedyardsigns.com/xkcp/
Decoy
-
plcnotary.com
-
pennywisebusiness.net
-
negatzone.com
-
hangclinic.com
-
choice-home-warranty-review.com
-
oslojistas.com
-
keguanchina.com
-
amazoncarbonhub.com
-
myworkaccident.com
-
shipu299.com
-
henselectrlc.com
-
store55588.com
-
11ncbee.net
-
reissantorini.com
-
karta.gold
-
goldenstatesurplus.net
-
soslifefood.com
-
bis-adapter.net
-
harrywalia.com
-
myboutiqueflowers.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43bc92909f85f8597f8bc5b573438615.exe"C:\Users\Admin\AppData\Local\Temp\43bc92909f85f8597f8bc5b573438615.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\43bc92909f85f8597f8bc5b573438615.exe"C:\Users\Admin\AppData\Local\Temp\43bc92909f85f8597f8bc5b573438615.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2116-116-0x0000000002240000-0x0000000002243000-memory.dmp
memory/2464-118-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2464-119-0x0000000000BD0000-0x0000000000EF0000-memory.dmp