Overview

overview

10

Static

static

3

e1e7b17c9e...60.exe

windows7-x64

10

e1e7b17c9e...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1e7b17c9e0a298346b82f04fabd4f60

  • Size

    604KB

  • Sample

    240327-rywa4aeb72

  • MD5

    e1e7b17c9e0a298346b82f04fabd4f60

  • SHA1

    735264e7cd43dca269582680ce3609eb5cac0418

  • SHA256

    239a8da808d8c8af3c89dda0bfeec6ab1f28a65fefca254e42ac993ee887abd0

  • SHA512

    929478f7a8a88cbbd7a31891cf886a24608bbbfcf5128d5e4683e50aa7cb916b1216194e2186eb2ea51c7511caecb4fac03fda3ae037dc22ceaf7522f6577f32

  • SSDEEP

    12288:KGFOsBgo0q4wMHDyKmBiFmK19sMS+2fI59BDNUHG4lBzGLTq9jbWBCVv:K4OsBgo0q4wMHDyKmBioI9sI2fI5PBU/

Score
10/10
formbookvd9nratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vd9n

Decoy

theunwrappedcollective.com

seckj-ic.com

tyresandover.com

thetrophyworld.com

fonggrconstruction.com

hopiproject.com

sktitle.com

charlotteobscurer.com

qjuhe.com

girlzglitter.com

createmylawn.com

hempcbgpill.com

zzdfdzkj.com

shreehariessential.com

226sm.com

getcupscall.com

neuralviolin.com

sanskaar.life

xn--fhqrm54yyukopc.com

togetherx4fantasy5star.today

Targets

    • Target

      e1e7b17c9e0a298346b82f04fabd4f60

    • Size

      604KB

    • MD5

      e1e7b17c9e0a298346b82f04fabd4f60

    • SHA1

      735264e7cd43dca269582680ce3609eb5cac0418

    • SHA256

      239a8da808d8c8af3c89dda0bfeec6ab1f28a65fefca254e42ac993ee887abd0

    • SHA512

      929478f7a8a88cbbd7a31891cf886a24608bbbfcf5128d5e4683e50aa7cb916b1216194e2186eb2ea51c7511caecb4fac03fda3ae037dc22ceaf7522f6577f32

    • SSDEEP

      12288:KGFOsBgo0q4wMHDyKmBiFmK19sMS+2fI59BDNUHG4lBzGLTq9jbWBCVv:K4OsBgo0q4wMHDyKmBioI9sI2fI5PBU/

    Score
    10/10
    formbookvd9nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks