Overview

overview

10

Static

static

ENC MARKET...ST.exe

windows7_x64

ENC MARKET...ST.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ENC MARKETING - INQUIRY AND SAMPLE REQUEST.exe

  • Size

    784KB

  • Sample

    211028-l4j75acaf9

  • MD5

    eceb569761c5237efe4ff7c787956b38

  • SHA1

    949cc8e780ff20589304b0cebb053cc6f11be342

  • SHA256

    f65ec74f53eb5438a1c900b9352fc7917d7e110b7b37c2e78d7c19f86b1f250e

  • SHA512

    83a1d51e605d4ee82b52dbac48429f6d5aa75574c68a26b7475f8d8af235ef5cd649b43342f7555a9a93b0a704b15a11dc048fc6054e8ca7f89af003342ba5c3

Score
10/10
formbookwarzoneratcnp0collectioninfostealerratspywarestealertrojan

Malware Config

Extracted

Family

warzonerat

C2

45.137.22.70:4198

Extracted

Family

formbook

Version

4.1

Campaign

cnp0

C2

http://www.ccnsv.net/cnp0/

Decoy

jiarenyuanhunlian.com

xquizitelashesnwaxx.com

rentinerie.com

herbalpedia-id.com

openseagames.com

re-swap.com

william-cook.com

segensv.com

versebay.com

brendanlairdsound.com

bypestor.com

hospitaldelpc.net

wwwroadrunnerfinancial.com

waterhammerstudios.com

hustleandbank.photography

secure01bchslogin.com

rarepeperanking.com

greatland.company

happybirthdayjewel.com

raheok.store

Targets

    • Target

      ENC MARKETING - INQUIRY AND SAMPLE REQUEST.exe

    • Size

      784KB

    • MD5

      eceb569761c5237efe4ff7c787956b38

    • SHA1

      949cc8e780ff20589304b0cebb053cc6f11be342

    • SHA256

      f65ec74f53eb5438a1c900b9352fc7917d7e110b7b37c2e78d7c19f86b1f250e

    • SHA512

      83a1d51e605d4ee82b52dbac48429f6d5aa75574c68a26b7475f8d8af235ef5cd649b43342f7555a9a93b0a704b15a11dc048fc6054e8ca7f89af003342ba5c3

    Score
    10/10
    formbookwarzoneratcnp0collectioninfostealerratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Formbook Payload

      rat

    • Warzone RAT Payload

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks