Analysis
- max time kernel
119s - max time network
129s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
18/11/2021, 15:50
General
- Target SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80240.31980.4427.exe
- Size 330KB
- Sample211118-s9ye9shee6
- SHA256 28b7c509a791caa6448666e9ea27d735770665cce23d0ca8a05404f41db299ec
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
h2b0
C2
-
http://www.brocoser.com/h2b0/
Decoy
-
coastmortgageloans.com
-
sejt.xyz
-
krisandmeigeni.com
-
personalbias.com
-
cubana-pablo.com
-
nipahvax.com
-
cxyzjsrc.com
-
trttanks.com
-
yoko-by.com
-
sbyidn.net
-
metainstagram.faith
-
katsuyatoken.com
-
trustminingfx.trade
-
xsightvideos.online
-
localemergencies.com
-
2ab0.com
-
idahofloat.com
-
ourdogdream.com
-
thebestmediaguy.com
-
forthesaltysouls.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80240.31980.4427.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80240.31980.4427.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80240.31980.4427.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80240.31980.4427.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3912-119-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3912-121-0x0000000000A30000-0x0000000000D50000-memory.dmp