Analysis
- max time kernel
106s - max time network
133s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
24/11/2021, 19:32
General
- Target 0e8ecafcc4dac9129241e73027dc38d6.exe
- Size 296KB
- Sample211124-x8y3maggd8
- SHA256 9df726f24b0a1282ca604a08a4648f527dae3e61712ea3954305362dc3ef4e10
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
jy0b
C2
-
http://www.filecrev.com/jy0b/
Decoy
-
lamejorimagen.com
-
mykabukibrush.com
-
modgon.com
-
barefoottherapeutics.com
-
shimpeg.net
-
trade-sniper.com
-
chiangkhancityhotel.com
-
joblessmoni.club
-
stespritsubways.com
-
chico-group.com
-
nni8.xyz
-
searchtypically.online
-
jobsyork.com
-
bestsales-crypto.com
-
iqmarketing.info
-
bullcityphotobooths.com
-
fwssc.icu
-
1oc87s.icu
-
usdiesel.xyz
-
secrets2optimumnutrition.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e8ecafcc4dac9129241e73027dc38d6.exe"C:\Users\Admin\AppData\Local\Temp\0e8ecafcc4dac9129241e73027dc38d6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0e8ecafcc4dac9129241e73027dc38d6.exe"C:\Users\Admin\AppData\Local\Temp\0e8ecafcc4dac9129241e73027dc38d6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4480-116-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4480-118-0x00000000009C0000-0x0000000000CE0000-memory.dmp