Overview

overview

10

Static

static

7.exe

windows7-x64

10

7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7.exe

  • Size

    217KB

  • Sample

    221125-s2944agg36

  • MD5

    3347779841d3da795c21302943eb3336

  • SHA1

    c06baa6711abdca45ef214fb071321de147a5b3f

  • SHA256

    bc07f5f2b53ecfe5def046099a57fb15658babfc18988d7b692c059fab32c249

  • SHA512

    6b9a358a6a2f3e1ed3811fafc0f730e47364cc6fd4fd77d139a72292e80e1985d0e17519ce24c6607e95c58651a2cefcc1d57c8b6ca49cb03b1f4ffb7ec896c4

  • SSDEEP

    6144:LEubXAxE9UJmPspuZMTexvFL6is5O+9R:LE8wxZIPlOTeFLHaP9

Score
10/10
formbookermrpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

ermr

Decoy

ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=

qNSdDhu/PT/1fgafDagiCSZH1SY=

wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=

jSxRvptHkeTGl7PT0SEmaZmjqzanuA==

b91oL+2wCcpyhnd6yvF6Pg==

mr81yp1/qqZX

hy7Xsz/PU/LWHMcGL4UYJx9n3A==

KlwrHt1gouPaXaWhoQ==

ng8M320IRJL9Ptw=

8GQbOXuaWxvKnNM=

XndOL7E5sNpVUNty4d/a

rryPBBC8PybYb+2h2MF3FHGL

kEoeyERSVCYO0g==

5/P+SBDby5hO

1fYXc30/h9W7iO17

34X+YKR+wRFE

8ir/X2MlVByh5lQ1ow8=

u9ikm2UMZ7J7hpCYow==

FLI+c3clp1BNDjVAfvC2Dnw=

t21Erq8/r09wAzAJTAH3Ng==

Targets

    • Target

      7.exe

    • Size

      217KB

    • MD5

      3347779841d3da795c21302943eb3336

    • SHA1

      c06baa6711abdca45ef214fb071321de147a5b3f

    • SHA256

      bc07f5f2b53ecfe5def046099a57fb15658babfc18988d7b692c059fab32c249

    • SHA512

      6b9a358a6a2f3e1ed3811fafc0f730e47364cc6fd4fd77d139a72292e80e1985d0e17519ce24c6607e95c58651a2cefcc1d57c8b6ca49cb03b1f4ffb7ec896c4

    • SSDEEP

      6144:LEubXAxE9UJmPspuZMTexvFL6is5O+9R:LE8wxZIPlOTeFLHaP9

    Score
    10/10
    formbookermrpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks