Overview

overview

10

Static

static

1

rquotationorda.exe

windows7-x64

10

rquotationorda.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rquotationorda.exe

  • Size

    700KB

  • Sample

    230324-qext5sge51

  • MD5

    6c38701adffd93212d6029444b59ccd6

  • SHA1

    6cd4d0ee67d3c2dc4d3c27952fe03d21af301f5f

  • SHA256

    a5976236ba0b3e31a6dd09af3abe7d0121a4053bb22669869a874d1ba97bd495

  • SHA512

    f8a2363f8438bdaf27eb5cf8d69f43b1823886a0600f06f57778e86b1080d4821206d869260d2ebfbfb2fd38c9c61988fe773ecd5e5f05e6ee827dc5dbe4ee63

  • SSDEEP

    12288:VOu8a0GY4jbPeeoVo8AL91kW9CUUCoStDH21X:JjbPJoV2L91CewB

Score
10/10
formbookn13eratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n13e

Decoy

cowiemarketing.com

uniqueliquidz.co.uk

755259.com

7bw95.com

luxbarstools.co.uk

baccaratda.com

berkayakpinar.xyz

gistus.africa

hjd387.com

leave-fly.com

golfclubdaddy.com

engineeringea.buzz

countryrevisited.com

decoracioneskalite.com

imaginationlirbary.com

moneytransfer.africa

brainwaveproject.com

3039sjbqf2022.com

184hotels.com

aromamiaro.com

Targets

    • Target

      rquotationorda.exe

    • Size

      700KB

    • MD5

      6c38701adffd93212d6029444b59ccd6

    • SHA1

      6cd4d0ee67d3c2dc4d3c27952fe03d21af301f5f

    • SHA256

      a5976236ba0b3e31a6dd09af3abe7d0121a4053bb22669869a874d1ba97bd495

    • SHA512

      f8a2363f8438bdaf27eb5cf8d69f43b1823886a0600f06f57778e86b1080d4821206d869260d2ebfbfb2fd38c9c61988fe773ecd5e5f05e6ee827dc5dbe4ee63

    • SSDEEP

      12288:VOu8a0GY4jbPeeoVo8AL91kW9CUUCoStDH21X:JjbPJoV2L91CewB

    Score
    10/10
    formbookn13eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks