General

  • Target

    S04307164.exe

  • Size

    601KB

  • Sample

    240719-km5xtsvhjh

  • MD5

    ea97d819850040fe87cb46ee9cf25166

  • SHA1

    759283e2eb410bb09ca8046d5fb9fb28e88b89aa

  • SHA256

    e35ac55cbd3d5f8449f8c2ba5521211f2ef4b1d00de6267d6f99cc83689fa8d5

  • SHA512

    7bb6ed10eaaa984500f908101fecff0b752a6b5763278e310ede0470e3e2de8fdbdcda7f9a31db592f0eb1c57017b85100bc6122493073a41099538ea5c1af9c

  • SSDEEP

    12288:MGrlAypLPwRrjrfnduSM8bQcrjZP3ebMHv3P7zJCBYkeyJj1MVN18kixb/:BAyps5FuSvZ/e4PqIyPMVXV

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy08

Decoy

weazc.top

servoceimmpajhnuz.info

vqemkdhi.xyz

wergol.com

spa-mk.com

rtpsid88.life

tatetits.fun

raidsa.xyz

suojiansuode.net

jointhejunction.com

wudai.net

typeboot.shop

mksport-app.com

miocloud.ovh

taipan77pandan.com

wwwhg58a.com

khuahamiksai31.pro

carpedatumllc.net

safebinders.com

krx21.com

Targets

    • Target

      S04307164.exe

    • Size

      601KB

    • MD5

      ea97d819850040fe87cb46ee9cf25166

    • SHA1

      759283e2eb410bb09ca8046d5fb9fb28e88b89aa

    • SHA256

      e35ac55cbd3d5f8449f8c2ba5521211f2ef4b1d00de6267d6f99cc83689fa8d5

    • SHA512

      7bb6ed10eaaa984500f908101fecff0b752a6b5763278e310ede0470e3e2de8fdbdcda7f9a31db592f0eb1c57017b85100bc6122493073a41099538ea5c1af9c

    • SSDEEP

      12288:MGrlAypLPwRrjrfnduSM8bQcrjZP3ebMHv3P7zJCBYkeyJj1MVN18kixb/:BAyps5FuSvZ/e4PqIyPMVXV

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks