General

  • Target
    7aca33a06ea660d4e2540da8b2c0bed2.exe
  • Size 766KB
  • Sample210111-twempwmflx
  • SHA256 c9bc1c7f21e628959622a569b2a4221b8a4cbcc34f3d01684da97bea5cd9caf7
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.theatomicshots.com/xle/

Decoy
  • tknbr.com

  • loyaloneconstruction.com

  • what-where.com

  • matebacapital.com

  • marriedandmore.com

  • qiemfsolutions.com

  • graececonsulting.com

  • www7456.com

  • littlefreecherokeelibrary.com

  • tailgatepawkinglot.com

  • musheet.com

  • tesfamariamtb.com

  • 1728025.com

  • xceltechuae.com

  • harperandchloe.com

  • thepamperedbarber.com

  • 5050alberta.com

  • supplychainstrainer.com

  • lacorte.group

  • ringingbear.com

Targets

    • Target
      7aca33a06ea660d4e2540da8b2c0bed2.exe
    • Size 766KB
    • SHA256 c9bc1c7f21e628959622a569b2a4221b8a4cbcc34f3d01684da97bea5cd9caf7
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks