Overview

overview

10

Static

static

Req No. 18...oc.rtf

windows7_x64

10

Req No. 18...oc.rtf

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Req No. 1807164 LP21.doc

  • Size

    1.5MB

  • Sample

    210118-dy5j2nxyq6

  • MD5

    33ce04c3aaff4168b756498f34429eaf

  • SHA1

    8d2526c297d691bf04cc1a3b3add8e2303841cdf

  • SHA256

    3687f2ed161b33f5c9dba06ac1bc784f15a83c353a594d2cf9724bcb6f9c56ff

  • SHA512

    3c641ddd9bdfff484f621d97fb7c4e1196f51cb7e5a0b81b2671351d5511909b811c0b8ac1aefec7180b215280afba889f5c2d7cedb4ecf214b5276d9289dcc7

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.raleighblacknursesrock.com/sly/

Decoy

nature-nectar.com

lavenderbunch.com

itsguapo.com

silabrenda.digital

madelynmason.com

uslawyer911.com

sumarjewelry.com

therefundexperts.com

smartunity.community

jamesdalby.com

7697vip3.com

bytethug.com

f22.info

positivechargerecycling.com

srimps.net

conversica.partners

chezmireillestore.com

ukiyoservices.com

catsdungeon.com

svactionwmdp7955.com

Targets

    • Target

      Req No. 1807164 LP21.doc

    • Size

      1.5MB

    • MD5

      33ce04c3aaff4168b756498f34429eaf

    • SHA1

      8d2526c297d691bf04cc1a3b3add8e2303841cdf

    • SHA256

      3687f2ed161b33f5c9dba06ac1bc784f15a83c353a594d2cf9724bcb6f9c56ff

    • SHA512

      3c641ddd9bdfff484f621d97fb7c4e1196f51cb7e5a0b81b2671351d5511909b811c0b8ac1aefec7180b215280afba889f5c2d7cedb4ecf214b5276d9289dcc7

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks