Overview

overview

10

Static

static

B7FAC1E02F...26.exe

windows7_x64

10

B7FAC1E02F...26.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    B7FAC1E02FC88D0DDCC8BEB8EFF3F726.exe

  • Size

    994KB

  • Sample

    220131-tl12xsach5

  • MD5

    b7fac1e02fc88d0ddcc8beb8eff3f726

  • SHA1

    ca56a06004d6bbed7ce64a9cea65dd2c3381f4d2

  • SHA256

    8aa6895af5216eec16b8fdb4f1bc66f140adc5bffb55b350fcae8b01e94e2eb0

  • SHA512

    9d2fa5956b79fe899191adbe4cde453632fb3ebeecfb61807296b06c1be6b4c63fb361ad981eba66ad0b67a6213bfa39e4eebdc9a6da5afbbc32666f3542459f

Score
10/10
formbookoh75persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oh75

Decoy

denizgidam.com

6cc06.com

charlottewaldburgzeil.com

medijanus.com

qingdaoyiersan.com

datcabilgisayar.xyz

111439d.com

xn--1ruo40k.com

wu6enxwcx5h3.xyz

vnscloud.net

brtka.xyz

showztime.com

promocoesdedezenbro.com

wokpy.com

chnowuk.online

rockshotscafe.com

pelrjy.com

nato-riness.com

feixiang-chem.com

thcoinexchange.com

Targets

    • Target

      B7FAC1E02FC88D0DDCC8BEB8EFF3F726.exe

    • Size

      994KB

    • MD5

      b7fac1e02fc88d0ddcc8beb8eff3f726

    • SHA1

      ca56a06004d6bbed7ce64a9cea65dd2c3381f4d2

    • SHA256

      8aa6895af5216eec16b8fdb4f1bc66f140adc5bffb55b350fcae8b01e94e2eb0

    • SHA512

      9d2fa5956b79fe899191adbe4cde453632fb3ebeecfb61807296b06c1be6b4c63fb361ad981eba66ad0b67a6213bfa39e4eebdc9a6da5afbbc32666f3542459f

    Score
    10/10
    formbookoh75ratspywarestealertrojanpersistence

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Formbook Payload

      rat

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks