Analysis
- max time kernel
121s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
09/11/2021, 12:59
General
- Target e1744ffeaede1509ce5eb48e8cb08361.exe
- Size 309KB
- Sample211109-p73enacdaq
- SHA256 415d8e7a309e0e7ea9cec8bd06f9170b0dc15aca3a553ff6fa7f6726997800a3
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
dyh6
C2
-
http://www.tttk8.site/dyh6/
Decoy
-
ximmgepn.xyz
-
bonitacandle.com
-
thesneakerhubofficial.com
-
miabags.online
-
maboxhistoire.com
-
viral22.com
-
gracebruno.xyz
-
safetycare.xyz
-
aerith.store
-
mountaingirlbbq.com
-
bhbuildertest-ecom.space
-
klhcn.com
-
guizhouhl.top
-
noreply-engagementboost.com
-
derdmlaucaty.store
-
viffetrade.com
-
iesyttsn.xyz
-
msumon.com
-
autoforos.com
-
carlosmorgan.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1744ffeaede1509ce5eb48e8cb08361.exe"C:\Users\Admin\AppData\Local\Temp\e1744ffeaede1509ce5eb48e8cb08361.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1744ffeaede1509ce5eb48e8cb08361.exe"C:\Users\Admin\AppData\Local\Temp\e1744ffeaede1509ce5eb48e8cb08361.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3096-116-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3096-118-0x0000000000AB0000-0x0000000000DD0000-memory.dmp