General

  • Target
    010-19.exe
  • Size 483KB
  • Sample201019-8y42pxmw1e
  • SHA256 540254a20d7d4aec2508a9db7e1fdb484ebc5bcec6ff72c919b17b5f0dbabdd7
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.crazyenergyguy.com/dmr/

Decoy
  • sweetjacks.com

  • onecleaningcare.company

  • learninglabels.com

  • onlinedesignstees.com

  • jjoxxdx.icu

  • nice-tights.com

  • golancpa.com

  • caringforeastcounty.com

  • whitesandretreat.com

  • 1823a.com

  • lazurii.com

  • madisons-deli.com

  • universitynude.com

  • michiganthyroid.com

  • hersidelinestyle.com

  • kumppaurics.com

  • sebicoin.net

  • hatmemama.com

  • oliyad.com

  • avoirbon.com

Targets

    • Target
      010-19.exe
    • Size 483KB
    • SHA256 540254a20d7d4aec2508a9db7e1fdb484ebc5bcec6ff72c919b17b5f0dbabdd7
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks