General

  • Target

    ee21511b610cd2a154c85c04c0e3d88f82b0ee835afd51247a1a7e97900cd733

  • Size

    549KB

  • Sample

    220201-db8q1sgba8

  • MD5

    4c1fcf062199b6d092a450fcb0d8439e

  • SHA1

    6379c769e997112874da5aa2b0695952e92a013c

  • SHA256

    ee21511b610cd2a154c85c04c0e3d88f82b0ee835afd51247a1a7e97900cd733

  • SHA512

    9bd29101a5aa4aad536ff5c2114140fcbc98682c4fcfd3b490ee086708e7f0ab4265a248032d31f0630dfd7b7a8bb6c20cba04b98255d18636bd945096268388

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

jo

Decoy

equipoarbitral.info

isoexercise.com

interactivenetworksystems.com

mozexnews.com

vkebfdkg.com

learntoearn.live

quomagazine.com

milkeknappford.com

missdailia.com

basames2009.com

babybirthdaycheers.com

philadelhiaflyers.com

saamcm.net

deyiclinic.com

politicalrubbish.com

1e0eighthell.men

buenosairespadelcourt.com

womenjiao.com

lubb26261.com

bastacasinosvenska.com

Targets

    • Target

      ee21511b610cd2a154c85c04c0e3d88f82b0ee835afd51247a1a7e97900cd733

    • Size

      549KB

    • MD5

      4c1fcf062199b6d092a450fcb0d8439e

    • SHA1

      6379c769e997112874da5aa2b0695952e92a013c

    • SHA256

      ee21511b610cd2a154c85c04c0e3d88f82b0ee835afd51247a1a7e97900cd733

    • SHA512

      9bd29101a5aa4aad536ff5c2114140fcbc98682c4fcfd3b490ee086708e7f0ab4265a248032d31f0630dfd7b7a8bb6c20cba04b98255d18636bd945096268388

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Formbook Payload

    • Sets service image path in registry

    • Deletes itself

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Tasks