Overview

overview

10

Static

static

Quotation.exe

windows7_x64

10

Quotation.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a80f0dc7d78c856762061e22220dfe00573b8fa65eea987efe3dc8f7433b15bf

  • Size

    202KB

  • Sample

    220521-nrf12shbdr

  • MD5

    0f1836a97f8fd8b15987266f6a59cdbc

  • SHA1

    171f6d5d9bc82351fa672e107b40aa902e660109

  • SHA256

    a80f0dc7d78c856762061e22220dfe00573b8fa65eea987efe3dc8f7433b15bf

  • SHA512

    e27741559932cd868455275305d982f8ea448becfb2bcc42c603725832d279577ad7c469ffdaef3cd58680868e8b86d85a9765442da35df21b1c4130ccefb9e2

Score
10/10
formbooknbcpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

nbc

Decoy

cargopower-tyre.com

blackworldbiz.com

pottedtreebooks.com

redlinefanatics.online

service-fee.info

greenlightcfo.com

mypetlink.pet

carewil.com

vippontooncharters.com

zxpcapital.com

dvdgfilms.com

worldsbestduchesses.com

testgoods.top

fujiyoshisougou.com

gage-consulting.com

yifangxuetang.net

imedialog.com

consinfotech.com

lorienttrading.com

ola-tienda.com

Targets

    • Target

      Quotation.exe

    • Size

      267KB

    • MD5

      1f2e931a76dbfac440c933b05a2c8e03

    • SHA1

      5a88cfede5d282779cd290241d00be1012967c1f

    • SHA256

      e8edf009c1c82f348ad925f7f9a34b4f241d52240c6cb43ab4536c4b363d5322

    • SHA512

      36d3fe9e87a96782c6444bdad565c3abee88c17905fe8ab8213b33d2af44c48b4dc2b2582f371e897978893b271161c7d0f8b975057038cdc02f589529e31c9b

    Score
    10/10
    formbooknbcpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks