Analysis
- max time kernel
110s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
29/11/2021, 15:26
General
- Target 96b16c7c68ed531cbb182605a3d5ae2a.exe
- Size 288KB
- Sample211129-st7c8sfda9
- SHA256 3bc25439a27fa2e9385f42bfc9b9a6caa56dc076ccc07fd2aa4684c0292c9622
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
dy26
C2
-
http://www.yukotopia.com/dy26/
Decoy
-
cincinnatitango.com
-
expoaudienceinfo.com
-
dongping.ltd
-
soundditafaga.club
-
energomir.net
-
luofengsanxiao.net
-
rightclicksave.online
-
nftlegend.store
-
terryexploration.com
-
uydutvboxweb.xyz
-
magusone.house
-
reinvestingunleashed.com
-
jlzft.com
-
taltexas.com
-
ricardoiranzo.com
-
yuanyiyouxi.com
-
altona.fitness
-
ntmusp.com
-
manazilalsham.com
-
politicagador.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96b16c7c68ed531cbb182605a3d5ae2a.exe"C:\Users\Admin\AppData\Local\Temp\96b16c7c68ed531cbb182605a3d5ae2a.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96b16c7c68ed531cbb182605a3d5ae2a.exe"C:\Users\Admin\AppData\Local\Temp\96b16c7c68ed531cbb182605a3d5ae2a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3124-116-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3124-118-0x00000000009E0000-0x0000000000D00000-memory.dmp