Analysis
- max time kernel
12s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
15/06/2021, 09:55
General
- Target 8449615a04b7ea85bc73fbede0cf0d95.exe
- Size 235KB
- Sample210615-wchnmsrsns
- SHA256 a7d608238504263bc730a5744ff6808c78d3003c658db1eec8a30ffd5152f257
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
C2
-
http://www.personalizedyardsigns.com/xkcp/
Decoy
-
plcnotary.com
-
pennywisebusiness.net
-
negatzone.com
-
hangclinic.com
-
choice-home-warranty-review.com
-
oslojistas.com
-
keguanchina.com
-
amazoncarbonhub.com
-
myworkaccident.com
-
shipu299.com
-
henselectrlc.com
-
store55588.com
-
11ncbee.net
-
reissantorini.com
-
karta.gold
-
goldenstatesurplus.net
-
soslifefood.com
-
bis-adapter.net
-
harrywalia.com
-
myboutiqueflowers.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8449615a04b7ea85bc73fbede0cf0d95.exe"C:\Users\Admin\AppData\Local\Temp\8449615a04b7ea85bc73fbede0cf0d95.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8449615a04b7ea85bc73fbede0cf0d95.exe"C:\Users\Admin\AppData\Local\Temp\8449615a04b7ea85bc73fbede0cf0d95.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1388-117-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1388-118-0x00000000009E0000-0x0000000000D00000-memory.dmp