General

  • Target

    dce983778e604b799e0470fd69e833f2

  • Size

    174KB

  • Sample

    220121-xkskyabadl

  • MD5

    dce983778e604b799e0470fd69e833f2

  • SHA1

    b97b22599b0b87bab09f24a7531c89d4cf35f5c2

  • SHA256

    2d40f472fa610ec9068b1bb4d057ca2293e2389fe7915acd2237b6df85e9b6b3

  • SHA512

    bac7da0e8730d35e1c160c22e578c93f70a7d75cf700874b8ab485b3c0056848e6c39ebe19f8dafe19dd8b379b4fb655c974593782a1a181172a735ca88a5416

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oh75

Decoy

denizgidam.com

6cc06.com

charlottewaldburgzeil.com

medijanus.com

qingdaoyiersan.com

datcabilgisayar.xyz

111439d.com

xn--1ruo40k.com

wu6enxwcx5h3.xyz

vnscloud.net

brtka.xyz

showztime.com

promocoesdedezenbro.com

wokpy.com

chnowuk.online

rockshotscafe.com

pelrjy.com

nato-riness.com

feixiang-chem.com

thcoinexchange.com

Targets

    • Target

      dce983778e604b799e0470fd69e833f2

    • Size

      174KB

    • MD5

      dce983778e604b799e0470fd69e833f2

    • SHA1

      b97b22599b0b87bab09f24a7531c89d4cf35f5c2

    • SHA256

      2d40f472fa610ec9068b1bb4d057ca2293e2389fe7915acd2237b6df85e9b6b3

    • SHA512

      bac7da0e8730d35e1c160c22e578c93f70a7d75cf700874b8ab485b3c0056848e6c39ebe19f8dafe19dd8b379b4fb655c974593782a1a181172a735ca88a5416

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Remote System Discovery

1
T1018

Tasks