General
- Target InquiryXforXQuotation.rar
- Size 1.8MB
- Sample260724-p4kensgc28
- SHA256 37471064f64d444ae89f427a4609ffe9df59908316708f10e0de291fb4809dcd
Score
10/10
Malware Config
Targets
-
- Target Inquiry for Quotation.js
- Size 5.2MB
- SHA256 9b9608fd3dba45d06fd93f4bfa0312b0e82d5605a848070631d4f4f5ffdb2e38
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1