Analysis
- max time kernel
118s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
18/11/2021, 10:38
General
- Target 3b7ed2c43e608053f737b3a1e82a1cfe.exe
- Size 291KB
- Sample211118-mpdx8sfed4
- SHA256 2f6e89afd122fb052c5ad063bfe784b854157f9ff99af0a8aae4b7d19641ff61
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
dyh6
C2
-
http://www.tttk8.site/dyh6/
Decoy
-
ximmgepn.xyz
-
bonitacandle.com
-
thesneakerhubofficial.com
-
miabags.online
-
maboxhistoire.com
-
viral22.com
-
gracebruno.xyz
-
safetycare.xyz
-
aerith.store
-
mountaingirlbbq.com
-
bhbuildertest-ecom.space
-
klhcn.com
-
guizhouhl.top
-
noreply-engagementboost.com
-
derdmlaucaty.store
-
viffetrade.com
-
iesyttsn.xyz
-
msumon.com
-
autoforos.com
-
carlosmorgan.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b7ed2c43e608053f737b3a1e82a1cfe.exe"C:\Users\Admin\AppData\Local\Temp\3b7ed2c43e608053f737b3a1e82a1cfe.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b7ed2c43e608053f737b3a1e82a1cfe.exe"C:\Users\Admin\AppData\Local\Temp\3b7ed2c43e608053f737b3a1e82a1cfe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3748-116-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3748-118-0x00000000009A0000-0x0000000000CC0000-memory.dmp