Overview

overview

10

Static

static

1

SecuriteIn...72.exe

windows7_x64

10

SecuriteIn...72.exe

windows10_x64

10

Analysis

  • max time kernel
    44s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    02/06/2021, 16:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.W32.AIDetect.malware2.24921.17572.exe
  • Size 235KB
  • Sample210602-cdtb9md5we
  • SHA256 f7699f895564624f542f4a0aee4357bedac9f6c6bb3fef74cf7cc8bfb72e4eba
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

C2

  • http://www.111bjs.com/ccr/

Decoy

  • abdullahlodhi.com

  • jevya.com

  • knoxvillerestaurant.com

  • mekarauroko7389.com

  • cricketspowder.net

  • johannchirinos.com

  • orangeorganical.com

  • libero-tt.com

  • lorenaegianluca.com

  • wintab.net

  • modernmillievintage.com

  • zgdqcyw.com

  • jeffabildgaardmd.com

  • nurulfikrimakassar.com

  • findyourchef.com

  • innovationsservicegroup.com

  • destek-taleplerimiz.com

  • whfqqco.icu

  • kosmetikmadeingermany.com

  • dieteticos.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 1 IoCs
    rat
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.24921.17572.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.24921.17572.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.24921.17572.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.24921.17572.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2588

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2588-117-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/2588-118-0x00000000009E0000-0x0000000000D00000-memory.dmp
        Download