Overview

overview

10

Static

static

VOMAXTRADING.doc

windows7_x64

10

VOMAXTRADING.doc

windows10_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    VOMAXTRADING.doc
  • Size 1.6MB
  • Sample201126-7ym4vd7kvs
  • SHA256 2664162d0341d8e5cf1cf3a290b77406d87111e3c9ff3fcf3a4f0836d15d3afe
  • MD5 SHA1 SHA512
Score
10/10
formbookpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.runwithit.media/bu43/

Decoy

  • bearrootstherapy.com

  • odmpay.com

  • johnfornmgov.com

  • astrodhaam.com

  • pumavps.com

  • empireconstructiontx.com

  • theboujeestop.com

  • indictthem.com

  • plantationbarnof1810.com

  • nsxs.xyz

  • lgshowroom.com

  • allinlifestyle.club

  • ik-com.net

  • saitamacity-sports.com

  • neuromuscularmassagetherapy.com

  • freespiritnutrition.com

  • alexanderhamilton.computer

  • happysay.co.uk

  • nndesignpr.com

  • lightweightmouldings.com

Targets

    • Target
      VOMAXTRADING.doc
    • Size 1.6MB
    • SHA256 2664162d0341d8e5cf1cf3a290b77406d87111e3c9ff3fcf3a4f0836d15d3afe
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks