Analysis
- max time kernel
104s - max time network
131s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
18/11/2021, 09:38
General
- Target cedc7056c435a629f10a443b40d6a818.exe
- Size 335KB
- Sample211118-ll3xhsccbr
- SHA256 0e2e801a0cc0e4257442d1243a17ae2ec7e7057cdb4a41a899d9aec7eb77cfbb
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
jy0b
C2
-
http://www.filecrev.com/jy0b/
Decoy
-
lamejorimagen.com
-
mykabukibrush.com
-
modgon.com
-
barefoottherapeutics.com
-
shimpeg.net
-
trade-sniper.com
-
chiangkhancityhotel.com
-
joblessmoni.club
-
stespritsubways.com
-
chico-group.com
-
nni8.xyz
-
searchtypically.online
-
jobsyork.com
-
bestsales-crypto.com
-
iqmarketing.info
-
bullcityphotobooths.com
-
fwssc.icu
-
1oc87s.icu
-
usdiesel.xyz
-
secrets2optimumnutrition.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cedc7056c435a629f10a443b40d6a818.exe"C:\Users\Admin\AppData\Local\Temp\cedc7056c435a629f10a443b40d6a818.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cedc7056c435a629f10a443b40d6a818.exe"C:\Users\Admin\AppData\Local\Temp\cedc7056c435a629f10a443b40d6a818.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3308-119-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3308-121-0x00000000009D0000-0x0000000000CF0000-memory.dmp