Analysis
- max time kernel
120s - max time network
135s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
28/10/2021, 12:51
General
- Target SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.19106.22726.exe
- Size 282KB
- Sample211028-p3gx6agdar
- SHA256 8a13ce3da212f3557c8d3f43a375fa6e030b400c2da2ca9701bed88f839863fc
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
dyh6
C2
-
http://www.tttk8.site/dyh6/
Decoy
-
ximmgepn.xyz
-
bonitacandle.com
-
thesneakerhubofficial.com
-
miabags.online
-
maboxhistoire.com
-
viral22.com
-
gracebruno.xyz
-
safetycare.xyz
-
aerith.store
-
mountaingirlbbq.com
-
bhbuildertest-ecom.space
-
klhcn.com
-
guizhouhl.top
-
noreply-engagementboost.com
-
derdmlaucaty.store
-
viffetrade.com
-
iesyttsn.xyz
-
msumon.com
-
autoforos.com
-
carlosmorgan.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.19106.22726.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.19106.22726.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.19106.22726.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.19106.22726.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4024-116-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4024-118-0x0000000000A70000-0x0000000000D90000-memory.dmp