Overview

overview

10

Static

static

3

Zahtjev za...DF.exe

windows7-x64

10

Zahtjev za...DF.exe

windows10-2004-x64

10

Zahtjev za...DF.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Zahtjev za ponudu broj։20240614․PDF.exe

  • Size

    750KB

  • Sample

    240614-pjr9sazhnb

  • MD5

    d688116a3ca06d07d4e09b88cd853371

  • SHA1

    6bd4c5334ce202a8a0a760a1ac928dd30c0e3b88

  • SHA256

    2edd3fb10eaa373a7a136ec50aa75c52441f99e2e0e1dba23cf21097b9ad45a5

  • SHA512

    94e42edbf1f83662b8243c26b87e53b620ca421581e0f52f9f4518858939b010c716922ba5a16e83f9ac8c22c392525dbe7453fd3800b1aaef042ab96028741b

  • SSDEEP

    12288:RDUH2iNPyCK2xrOoupuw0zgi9FIQgwf//I3CMSrl7sa8w2xaYjYxEf7FyTjwTTBe:RDs15yC57zguFIQ9u1XD7kYzj8ITA

Score
10/10
formbookdn03executionratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn03

Decoy

almouranipainting.com

cataloguia.shop

zaparielectric.com

whcqsc.com

ioco.in

aduredmond.com

vavada611a.fun

humtivers.com

jewellerytml.com

mcapitalparticipacoes.com

inhlcq.shop

solanamall.xyz

moviepropgroup.com

thegenesis.ltd

cyberxdefend.com

skinbykoco.com

entermintlead.com

honestaireviews.com

wyclhj7gqfustzp.buzz

w937xb.com

Targets

    • Target

      Zahtjev za ponudu broj։20240614․PDF.exe

    • Size

      750KB

    • MD5

      d688116a3ca06d07d4e09b88cd853371

    • SHA1

      6bd4c5334ce202a8a0a760a1ac928dd30c0e3b88

    • SHA256

      2edd3fb10eaa373a7a136ec50aa75c52441f99e2e0e1dba23cf21097b9ad45a5

    • SHA512

      94e42edbf1f83662b8243c26b87e53b620ca421581e0f52f9f4518858939b010c716922ba5a16e83f9ac8c22c392525dbe7453fd3800b1aaef042ab96028741b

    • SSDEEP

      12288:RDUH2iNPyCK2xrOoupuw0zgi9FIQgwf//I3CMSrl7sa8w2xaYjYxEf7FyTjwTTBe:RDs15yC57zguFIQ9u1XD7kYzj8ITA

    Score
    10/10
    formbookdn03executionratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks