Overview

overview

10

Static

static

2feb4df65e...24.exe

windows7_x64

1

2feb4df65e...24.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2feb4df65e22132bda72311108f6da24.exe

  • Size

    770KB

  • Sample

    220706-jdyxgscba4

  • MD5

    2feb4df65e22132bda72311108f6da24

  • SHA1

    8a165756d84094a9ac840f83fd7370f158b233c2

  • SHA256

    141d09dc3b6f2084a35fbc63ea487e6786c91975ad7868caacbed9ecfa685a6b

  • SHA512

    6a3b4e006fa1c411db2eab4f8ebd0f8aefc3b721c545a182e771d656a9b88e6af48d98d632f755c22f4d2bf97be4bfa57359635c226ecdc445b9390cadb61a10

Score
10/10
formbookmodiloadert3c9persistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

t3c9

Decoy

waidfu.com

sjglyshsv.com

sdztgy.com

health-magazines.info

bajoarmadura.com

oxian.xyz

jonspearman.com

fusodu.online

jx1718.net

arminva6tinderella.xyz

susuhiwah.com

novotherm.online

superbloomerz.com

kuaida56.com

74hc86.com

stellumml.com

neurocalibration.com

pinkspirit.store

solitaipat.com

eassiy.com

Targets

    • Target

      2feb4df65e22132bda72311108f6da24.exe

    • Size

      770KB

    • MD5

      2feb4df65e22132bda72311108f6da24

    • SHA1

      8a165756d84094a9ac840f83fd7370f158b233c2

    • SHA256

      141d09dc3b6f2084a35fbc63ea487e6786c91975ad7868caacbed9ecfa685a6b

    • SHA512

      6a3b4e006fa1c411db2eab4f8ebd0f8aefc3b721c545a182e771d656a9b88e6af48d98d632f755c22f4d2bf97be4bfa57359635c226ecdc445b9390cadb61a10

    Score
    10/10
    formbookmodiloadert3c9persistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • ModiLoader Second Stage

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks