Overview

overview

10

Static

static

yeni sipari?.exe

windows7_x64

10

yeni sipari?.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f466700a7f45a812f832c3d869bd6453aef3a292f3e2cccc39b18e20a3e05203

  • Size

    570KB

  • Sample

    220521-b945dagefj

  • MD5

    197120fbf7a74115cccd479fda8ea4ab

  • SHA1

    7707a427178a01fa1b3aeccee3e67b912347cdcc

  • SHA256

    f466700a7f45a812f832c3d869bd6453aef3a292f3e2cccc39b18e20a3e05203

  • SHA512

    a1fb4ba77783f3ac1899108f993d2adf4e8442d3d0fe1de773bd73c1a9ed994b296c98891763d135364529c8bb9544ee34fd0a6191239b17c44fb0bafe00ddae

Score
10/10
formbookkvszpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kvsz

Decoy

krii8it.com

etroty.com

siliconetechsolutions.com

idoukang.net

jb5w3c.download

cmvtulancingo.com

duniageo.com

therisc.com

recruitwith-rr.com

liential.com

americavolcano.win

miyario.com

theballerinashoecompany.com

43u99.com

hananoame.com

wwwglowhaus.net

crowdcoins.biz

icograda.net

fujiansoles.com

bliss-okachimachi.com

Targets

    • Target

      yeni sipari?.exe

    • Size

      719KB

    • MD5

      2209b47aae001d2bd001bfdefc337f68

    • SHA1

      bb4984f3c1f8780069ec094b93668e9c45d65187

    • SHA256

      ace900e217f27e8f699718623c3c2dcc7bf91337ff0ff91fc5a365a68fd7ba65

    • SHA512

      d206f7aa864fce2e4592842fbd50b05ef937d756a1078884e6c19cf65adfe61e205b7e1a4f6350a503a323cda216036b7301919e7ec70aa6840edc2bed8b8ea0

    Score
    10/10
    formbookkvszratspywarestealertrojanpersistencesuricata

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks