Analysis
- max time kernel
121s - max time network
121s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
01/12/2021, 17:24
General
- Target 6092f193b2b1a3b8f7c00482aff6243f.exe
- Size 261KB
- Sample211201-vyqmdsecen
- SHA256 f383f40cc25197aa00a470f4b549f6da97293ebd87dd80b099d59d5fc7a2dab4
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
cf27
C2
-
http://www.itesparii.quest/cf27/
Decoy
-
sas009.com
-
moodior.com
-
htxhaivanquynhnhai.com
-
clutch-car.com
-
lumgf.xyz
-
rachelnebozuk.com
-
myke.codes
-
megaprotorgss.club
-
99soles.com
-
robinsongrewalcpa.com
-
thehourlymotherpodcast.com
-
daxvly.xyz
-
poygik.store
-
ctws-llc.com
-
itsbrunosworld.com
-
jewelsbynaya.com
-
bba-seguiridad.com
-
fuchspack.info
-
skidxllc.com
-
ghi9.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6092f193b2b1a3b8f7c00482aff6243f.exe"C:\Users\Admin\AppData\Local\Temp\6092f193b2b1a3b8f7c00482aff6243f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6092f193b2b1a3b8f7c00482aff6243f.exe"C:\Users\Admin\AppData\Local\Temp\6092f193b2b1a3b8f7c00482aff6243f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1048-55-0x0000000074E51000-0x0000000074E53000-memory.dmp
memory/1100-57-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1100-59-0x0000000000800000-0x0000000000B03000-memory.dmp