General

  • Target

    Potvrda narudzbe u prilogu.exe

  • Size

    858KB

  • Sample

    220307-jcdj6aadg3

  • MD5

    a2f2b4df19c4e17b1ee75386984be107

  • SHA1

    4eeb4fa7a57f39c7e0e33f069da955086926976a

  • SHA256

    2fa540a1679ecd37874e53b50eb4c756223420d5f970c935ce053345f1f231f4

  • SHA512

    c69eb0311d8e9d760f7ab33568b56836645dadf9c41271e0ef494816d3ba3a24c1a119e9359950fda5bdc92f2f38fe3bb99e346977ed935cc119ba0c690dab64

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Targets

    • Target

      Potvrda narudzbe u prilogu.exe

    • Size

      858KB

    • MD5

      a2f2b4df19c4e17b1ee75386984be107

    • SHA1

      4eeb4fa7a57f39c7e0e33f069da955086926976a

    • SHA256

      2fa540a1679ecd37874e53b50eb4c756223420d5f970c935ce053345f1f231f4

    • SHA512

      c69eb0311d8e9d760f7ab33568b56836645dadf9c41271e0ef494816d3ba3a24c1a119e9359950fda5bdc92f2f38fe3bb99e346977ed935cc119ba0c690dab64

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Formbook Payload

    • ModiLoader Second Stage

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks