Overview

overview

10

Static

static

tmp.exe

windows7_x64

10

tmp.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    632KB

  • Sample

    220705-xkdf1sdgh3

  • MD5

    cb38d8143b2216edab036acee36f25b4

  • SHA1

    1401d9123df44612f599865e9b2df8941779c687

  • SHA256

    7fd0e394a9d74592a74d04b3dccf2dcf8457d0e894cadadbf999c327e9b3940e

  • SHA512

    15315313dc0cc805771c7a3ccdf20851e39279a001272cdf71e1078fd7b907d83ffa6fc6292e83743963849ea1b2433036e746c8377edf8f6c9dcb2f76e2f010

Score
10/10
formbookxloaderloaderpersistenceratspywarestealersuricatatrojan

Malware Config

Targets

    • Target

      tmp

    • Size

      632KB

    • MD5

      cb38d8143b2216edab036acee36f25b4

    • SHA1

      1401d9123df44612f599865e9b2df8941779c687

    • SHA256

      7fd0e394a9d74592a74d04b3dccf2dcf8457d0e894cadadbf999c327e9b3940e

    • SHA512

      15315313dc0cc805771c7a3ccdf20851e39279a001272cdf71e1078fd7b907d83ffa6fc6292e83743963849ea1b2433036e746c8377edf8f6c9dcb2f76e2f010

    Score
    10/10
    formbookxloaderloaderpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks