Analysis
- max time kernel
122s - max time network
125s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
24/11/2021, 20:00
General
- Target 586f7a1895ea47a462b1d5f6a43fcd33.exe
- Size 309KB
- Sample211124-yq1deaggf3
- SHA256 1358d88e078f1c59b546256968179bf213928f1e6f4e7afa255681b2cd8f92a2
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
vngb
C2
-
http://www.gvlc0.club/vngb/
Decoy
-
omertalasvegas.com
-
payyep.com
-
modasportss.com
-
gestionestrategicadl.com
-
teamolemiss.club
-
geektranslate.com
-
versatileventure.com
-
athletic-hub.com
-
vitanovaretreats.com
-
padison8t.com
-
tutoeasy.com
-
ediblewholesale.com
-
kangrungao.com
-
satode.com
-
prohibitionfeeds.com
-
getmorevacations.com
-
blinkworldbeauty.com
-
kdlabsallr.com
-
almanasef.com
-
transportationservicellc.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\586f7a1895ea47a462b1d5f6a43fcd33.exe"C:\Users\Admin\AppData\Local\Temp\586f7a1895ea47a462b1d5f6a43fcd33.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\586f7a1895ea47a462b1d5f6a43fcd33.exe"C:\Users\Admin\AppData\Local\Temp\586f7a1895ea47a462b1d5f6a43fcd33.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1056-57-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1056-59-0x0000000000700000-0x0000000000A03000-memory.dmp
memory/1900-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp