Overview

overview

10

Static

static

3

comutation order.exe

windows7-x64

10

comutation order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    comutation order.exe

  • Size

    744KB

  • Sample

    230501-srfgqsbc8t

  • MD5

    d24b6d72e85c9b51bd5b39b9fe6d1ab5

  • SHA1

    b2c1c8c1988924942a231cf30dfc5222b031090e

  • SHA256

    e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5

  • SHA512

    d37ff374ab0f381051e8e1c27d4b181a57e62fa3f8775616739421261b7032f94ec229b84c0f0a686bbbce95f69e7a2b2a0269239773c7dc76ff0f01ce8c9b6e

  • SSDEEP

    12288:iQu6zWFuIRiPLFuJVygB1VrQ6GSItioHVnwlb1:iSIuIwZwAgrVr6NHFwlb

Score
10/10
formbookn13eratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n13e

Decoy

cowiemarketing.com

uniqueliquidz.co.uk

755259.com

7bw95.com

luxbarstools.co.uk

baccaratda.com

berkayakpinar.xyz

gistus.africa

hjd387.com

leave-fly.com

golfclubdaddy.com

engineeringea.buzz

countryrevisited.com

decoracioneskalite.com

imaginationlirbary.com

moneytransfer.africa

brainwaveproject.com

3039sjbqf2022.com

184hotels.com

aromamiaro.com

Targets

    • Target

      comutation order.exe

    • Size

      744KB

    • MD5

      d24b6d72e85c9b51bd5b39b9fe6d1ab5

    • SHA1

      b2c1c8c1988924942a231cf30dfc5222b031090e

    • SHA256

      e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5

    • SHA512

      d37ff374ab0f381051e8e1c27d4b181a57e62fa3f8775616739421261b7032f94ec229b84c0f0a686bbbce95f69e7a2b2a0269239773c7dc76ff0f01ce8c9b6e

    • SSDEEP

      12288:iQu6zWFuIRiPLFuJVygB1VrQ6GSItioHVnwlb1:iSIuIwZwAgrVr6NHFwlb

    Score
    10/10
    formbookn13eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks