Overview

overview

10

Static

static

1

scan001.exe

windows7-x64

10

scan001.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scan001.exe

  • Size

    338KB

  • Sample

    221208-y8evesbd52

  • MD5

    e6c47976b4d53fd52464cfc18c8a57af

  • SHA1

    31bf2e8c7b123cd7c04899fb64bbe3832823e217

  • SHA256

    b3bcb18dda143e601f302a1cd248189f553d03ffbd707a05a3df3048f0c5b407

  • SHA512

    28d927de8a6a44ea0eea2789b4f2d6b73a21a38072fdf28242a79fcdea06244229c088c922e87fd8556c0dc774af97483ac66a73b3ef3a8d22b6858a37740753

  • SSDEEP

    6144:9kwUZdjCHZAGW3UgK9Xa64EIcdM5Rqyz7t/SLkopNYXhH7jsL2Sk8csUv3YWlZ:QdjM6UgiXpycW3qaRkkyNq7jU2SVUv3B

Score
10/10
formbook9qtpratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

9qtp

Decoy

0BbXnywB2jUlm9nKiMma

R5A2IaujqtD/dAqI8Y0IpQ==

hOvaxGAt51Bx33P7Vyt6XPnYWw==

IDg+M/RH+D5aQ18d8Y0IpQ==

W1xH1/2HTrysGWEUdK2equ4Y

qHgkqNn4xTo4

8S7brii3eMzty+KgvBqIXPnYWw==

j8x44wKIXrW2tRiH8Y0IpQ==

GywuINvBRm2eaNY=

dTja44gPmQhkiaLZ

s6aIdgBm7Dx5fsUB2rE=

m5h7cA6JHX1p5ylfoc4ouA==

uDxNFJgassFFTdQ=

RERUNcLCgdAOabklo1PDTjf5Uw==

pKeadO1BswJQKXZ0tAkBF9wkNVs=

xd7Yr00rxzGBNlS1XA==

01Jd2fhoQpThdH5Sc8sprQ==

oOSWBCeNDDWeB8M=

EV8ae4iFCmdrT78Zr6VnObkG

Ghkc7nZnXXPEOX1FUToisZc=

Targets

    • Target

      scan001.exe

    • Size

      338KB

    • MD5

      e6c47976b4d53fd52464cfc18c8a57af

    • SHA1

      31bf2e8c7b123cd7c04899fb64bbe3832823e217

    • SHA256

      b3bcb18dda143e601f302a1cd248189f553d03ffbd707a05a3df3048f0c5b407

    • SHA512

      28d927de8a6a44ea0eea2789b4f2d6b73a21a38072fdf28242a79fcdea06244229c088c922e87fd8556c0dc774af97483ac66a73b3ef3a8d22b6858a37740753

    • SSDEEP

      6144:9kwUZdjCHZAGW3UgK9Xa64EIcdM5Rqyz7t/SLkopNYXhH7jsL2Sk8csUv3YWlZ:QdjM6UgiXpycW3qaRkkyNq7jU2SVUv3B

    Score
    10/10
    formbook9qtpratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks