General

  • Target

    rBillOfQuantity.exe

  • Size

    1019KB

  • Sample

    230329-pg6pdsgc42

  • MD5

    ddad0a4e5226bcf08e4831ce7b07d730

  • SHA1

    2adae1b731e73c8e04086ecbf4af4baa0755f869

  • SHA256

    a6821b8dbe19bb7e7b1b43e26f7a48c4b3ded583ff774e7a754b303af70ffe10

  • SHA512

    fa8a088513c615fc324a19b470b787ca1b974073769424aed6b814d1eca78ce8232ebd72f5c740799ed83e57140916152cfec4edead40272b5cfe437597ad524

  • SSDEEP

    24576:D12zVZ9L604wT9KmnwHBxxvRN4CaNFsBXN4K:DAR3LR4wTTwXWCOqd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jr22

Decoy

941zhe.com

lunarportal.space

xn--osmaniyeiek-t9ab.online

trejoscar.com

nrnursery.com

quizcannot.cfd

seedstockersthailand.com

watsonwindow.com

wjfholdings.com

weziclondon.com

naruot.xyz

yeji.plus

classicmenstore.com

oharatravel.com

therapyplankits.com

keviegreshonpt.com

qdlyner.com

seithupaarungal.com

casinorates.online

8ug4as.icu

Targets

    • Target

      rBillOfQuantity.exe

    • Size

      1019KB

    • MD5

      ddad0a4e5226bcf08e4831ce7b07d730

    • SHA1

      2adae1b731e73c8e04086ecbf4af4baa0755f869

    • SHA256

      a6821b8dbe19bb7e7b1b43e26f7a48c4b3ded583ff774e7a754b303af70ffe10

    • SHA512

      fa8a088513c615fc324a19b470b787ca1b974073769424aed6b814d1eca78ce8232ebd72f5c740799ed83e57140916152cfec4edead40272b5cfe437597ad524

    • SSDEEP

      24576:D12zVZ9L604wT9KmnwHBxxvRN4CaNFsBXN4K:DAR3LR4wTTwXWCOqd

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks