Overview

overview

10

Static

static

DOCUMENTO ...2).exe

windows7-x64

10

DOCUMENTO ...2).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DOCUMENTO DE RECEPCIÓN AWB DHL57804239,pdf (2).exe

  • Size

    489KB

  • Sample

    221005-mgjhraecck

  • MD5

    7751991a2490dad1c2ce26a58fe094bf

  • SHA1

    da431fe093f2fd4e00682883e9860ed6a7d1b674

  • SHA256

    da13e9095eb32d1f2fa9ebe7d5abff767003effa4edc31989208e1a586899269

  • SHA512

    1af2992ecea1a0eec1d03c2f100a6fc56a86343460ac117379eed052fca486501b28751ea11d51d0c75d1fef3322c6fc726ea375d95d61a986fdc397b857343c

  • SSDEEP

    12288:wToPWBv/cpGrU3yDImIwSG0qhUsKv54HlqgMbJNv:wTbBv5rUDmIF6hUsKSFqBx

Score
10/10
formbookxloadernrlnloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

nrln

Decoy

IG7zJSm49UqTTuu/N/oTCIg=

CVLdAPgw0CRSMuZnRRU=

PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG

5i6p4GeQqtBgNRfGNQ==

5984keYswxh8mGZHz4ipAHtQ

VNJaK4Gh0CrOvHpW/p353A==

71rEtrL2icToyKGhcWrTxjsFU5T98zeO

r3q1sy1iZaL+2XIUAob7yw==

9+83Qkrk/vV/jVXsDvoTCIg=

aMFAgYF1prov8/UErH/Y1A==

Alqtx/0rxwEbCLdudftl

ImCbnglBSUHF0mv2tTSP40bPeYao

s4DFNvAJ4GIJ+g==

phOa6mtS8QQICuZnRRU=

7TSu5vqRtB45EZtf4WDSTBHPeYao

ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=

HF7jKjbGox2SAffTPw==

yAM3mOQot5l+cD0ikR5MGp8=

UYzW0/8z70JcQenVLidu1kLPeYao

OoCznp5UWz+hT9OBFXbfVhXPeYao

Extracted

Family

xloader

Version

3.8

Campaign

nrln

Decoy

IG7zJSm49UqTTuu/N/oTCIg=

CVLdAPgw0CRSMuZnRRU=

PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG

5i6p4GeQqtBgNRfGNQ==

5984keYswxh8mGZHz4ipAHtQ

VNJaK4Gh0CrOvHpW/p353A==

71rEtrL2icToyKGhcWrTxjsFU5T98zeO

r3q1sy1iZaL+2XIUAob7yw==

9+83Qkrk/vV/jVXsDvoTCIg=

aMFAgYF1prov8/UErH/Y1A==

Alqtx/0rxwEbCLdudftl

ImCbnglBSUHF0mv2tTSP40bPeYao

s4DFNvAJ4GIJ+g==

phOa6mtS8QQICuZnRRU=

7TSu5vqRtB45EZtf4WDSTBHPeYao

ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=

HF7jKjbGox2SAffTPw==

yAM3mOQot5l+cD0ikR5MGp8=

UYzW0/8z70JcQenVLidu1kLPeYao

OoCznp5UWz+hT9OBFXbfVhXPeYao

Targets

    • Target

      DOCUMENTO DE RECEPCIÓN AWB DHL57804239,pdf (2).exe

    • Size

      489KB

    • MD5

      7751991a2490dad1c2ce26a58fe094bf

    • SHA1

      da431fe093f2fd4e00682883e9860ed6a7d1b674

    • SHA256

      da13e9095eb32d1f2fa9ebe7d5abff767003effa4edc31989208e1a586899269

    • SHA512

      1af2992ecea1a0eec1d03c2f100a6fc56a86343460ac117379eed052fca486501b28751ea11d51d0c75d1fef3322c6fc726ea375d95d61a986fdc397b857343c

    • SSDEEP

      12288:wToPWBv/cpGrU3yDImIwSG0qhUsKv54HlqgMbJNv:wTbBv5rUDmIF6hUsKSFqBx

    Score
    10/10
    formbooknrlnratspywarestealertrojanxloaderloader

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks