Overview

overview

10

Static

static

3

de54d09b2e...cf.exe

windows7-x64

10

de54d09b2e...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de54d09b2e5a11e53882717a0b6f2acf

  • Size

    483KB

  • Sample

    240325-stbassbf66

  • MD5

    de54d09b2e5a11e53882717a0b6f2acf

  • SHA1

    1fabe3f47bbb8c447e46a52af8d18391e06cb526

  • SHA256

    10df2213f27d0cd324bed9e5b9d24684613ee93bbb4d3f3b36a0573379a53eed

  • SHA512

    996ab526eff0628c0373a263ba2be53bbf33ef62046a179e3442d5dd20568867c9af5fe23520ff018a8ec6ab80bccfb07f52a89008907af31d4d103f05e7d4c5

  • SSDEEP

    6144:4IFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9f:lh8Mz+sv3y2N1xzAZprkmuN/SD5iKefd

Score
10/10
formbookowpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ow

Decoy

piavecaffe.com

jlxkqg.men

lifesavingfoundation.net

karadasama.net

michaeltraolach-macsweeney.com

thunderwatches.com

serviciocasawhirlpool.biz

c-cap.online

itparksolution.com

clarityhearingkw.com

wpgrosiri.date

colemarshalcambell.com

webperffest.com

adjusterforirma.info

buildersqq.com

spiritualwisdominindia.com

111222333.net

traditionalarabicdishes.com

hmlifi.com

receive-our-info-heredaily.info

Targets

    • Target

      de54d09b2e5a11e53882717a0b6f2acf

    • Size

      483KB

    • MD5

      de54d09b2e5a11e53882717a0b6f2acf

    • SHA1

      1fabe3f47bbb8c447e46a52af8d18391e06cb526

    • SHA256

      10df2213f27d0cd324bed9e5b9d24684613ee93bbb4d3f3b36a0573379a53eed

    • SHA512

      996ab526eff0628c0373a263ba2be53bbf33ef62046a179e3442d5dd20568867c9af5fe23520ff018a8ec6ab80bccfb07f52a89008907af31d4d103f05e7d4c5

    • SSDEEP

      6144:4IFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9f:lh8Mz+sv3y2N1xzAZprkmuN/SD5iKefd

    Score
    10/10
    formbookowpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks