General

  • Target

    412f36cadb0568c43f0738c6a832f9096fa5692c8271b1e322b570152084dc31.exe

  • Size

    1.1MB

  • Sample

    240715-t8dvxasfmc

  • MD5

    e8b684a181e745c7e80acaa0dfa96193

  • SHA1

    cf5c3059ac345cb5fd3d943e3a5a27642ad2da0f

  • SHA256

    412f36cadb0568c43f0738c6a832f9096fa5692c8271b1e322b570152084dc31

  • SHA512

    69f505d8bcc98a657b847ebc7a30e33c2f80394cc92dc7dca2fc2af7566678f4929324ffa73d5fc42a7bd8e17940ebcf108b6b75eca10cb3e196b104c8fdcc2c

  • SSDEEP

    24576:ypwQaLmSnf3XrxwPr/Od/wLq7Mm9OCH8MIRi4Kq2:ypimentiWd7PX4R2

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dk07

Decoy

reclam.xyz

parchmentmediaadd.com

gaolibai.site

menage-exclusif.com

ceremoniesbyjade.com

5663876.com

take3.xyz

environmentaladvocacygroup.com

fp38z.rest

elektro-vlasic.com

bollybytestv.com

udfunsd.cloud

studiomiraiarq.com

e-commercebrasil.shop

sansiddhiedu.com

draaronroughan.net

24angel.com

rjh-equestrian.com

22db3rgdg6a73pea7.vip

mintygreen-wellnessportal.com

Targets

    • Target

      412f36cadb0568c43f0738c6a832f9096fa5692c8271b1e322b570152084dc31.exe

    • Size

      1.1MB

    • MD5

      e8b684a181e745c7e80acaa0dfa96193

    • SHA1

      cf5c3059ac345cb5fd3d943e3a5a27642ad2da0f

    • SHA256

      412f36cadb0568c43f0738c6a832f9096fa5692c8271b1e322b570152084dc31

    • SHA512

      69f505d8bcc98a657b847ebc7a30e33c2f80394cc92dc7dca2fc2af7566678f4929324ffa73d5fc42a7bd8e17940ebcf108b6b75eca10cb3e196b104c8fdcc2c

    • SSDEEP

      24576:ypwQaLmSnf3XrxwPr/Od/wLq7Mm9OCH8MIRi4Kq2:ypimentiWd7PX4R2

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks