Overview

overview

10

Static

static

04904ee3c2...de.exe

windows7_x64

10

04904ee3c2...de.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04904ee3c242df036eaa677adc6919681c98997bf01b9b3ee4bbc46ceb2060de

  • Size

    1.1MB

  • Sample

    220520-xxvwtsfehn

  • MD5

    5625e7b85f79da85c23454b98e25d6a0

  • SHA1

    3532aa30bade75df2e45d213e6fbace4e9b1faff

  • SHA256

    04904ee3c242df036eaa677adc6919681c98997bf01b9b3ee4bbc46ceb2060de

  • SHA512

    d0c7d34a9f0d20859ee8dd087f7eaa82f11e4d1982cf52205d5d5901b0093f8582e0d0f553e0803c2de66496167400cd464e6d28a6f33da26a2547e198b3493a

Score
10/10
formbookmodiloader3noppersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Targets

    • Target

      04904ee3c242df036eaa677adc6919681c98997bf01b9b3ee4bbc46ceb2060de

    • Size

      1.1MB

    • MD5

      5625e7b85f79da85c23454b98e25d6a0

    • SHA1

      3532aa30bade75df2e45d213e6fbace4e9b1faff

    • SHA256

      04904ee3c242df036eaa677adc6919681c98997bf01b9b3ee4bbc46ceb2060de

    • SHA512

      d0c7d34a9f0d20859ee8dd087f7eaa82f11e4d1982cf52205d5d5901b0093f8582e0d0f553e0803c2de66496167400cd464e6d28a6f33da26a2547e198b3493a

    Score
    10/10
    formbookmodiloader3noppersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • ModiLoader Second Stage

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks