Overview

overview

10

Static

static

Order No.4...oc.rtf

windows7_x64

10

Order No.4...oc.rtf

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order No.428 1-18-2021 BA URUS BINA (M) SDN BHD.doc

  • Size

    1.5MB

  • Sample

    210118-sgl59xp1lj

  • MD5

    6afa446a78ee1e4003e2419c4b3ff648

  • SHA1

    d8ab568179d3dae50e76e7ff0aa6ecb18da84377

  • SHA256

    052c6dd23430c3cb18615febd286a20e4fbfdcaa66f45d00b0f8fa1d1e70d92b

  • SHA512

    73b0d69a4a134ced282db75f0de06c426db87620bbddf8f030bd2658efe3cc5adf392a5a9ab9a3900b6820010eed2f6c227d2dd9e78121781e7967f3e6443ee2

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.histasinsaat.com/lbn/

Decoy

sanfordrubenstein.net

snehamsolutions.com

sinteredfilter.net

cabinetbernat.com

misatani.com

buttlickhollow.com

alkhatalaswadcomputer.com

odiamonds.jewelry

persentage.club

shesthemanunited.com

boxstaging.com

thetwelvepercentstore.com

mlwgsjabberwock.com

sportscardhq.com

philadelphiaartgallery.com

globalgambling.com

czwykj.com

dizivadi.com

emmaluther.com

searko.com

Targets

    • Target

      Order No.428 1-18-2021 BA URUS BINA (M) SDN BHD.doc

    • Size

      1.5MB

    • MD5

      6afa446a78ee1e4003e2419c4b3ff648

    • SHA1

      d8ab568179d3dae50e76e7ff0aa6ecb18da84377

    • SHA256

      052c6dd23430c3cb18615febd286a20e4fbfdcaa66f45d00b0f8fa1d1e70d92b

    • SHA512

      73b0d69a4a134ced282db75f0de06c426db87620bbddf8f030bd2658efe3cc5adf392a5a9ab9a3900b6820010eed2f6c227d2dd9e78121781e7967f3e6443ee2

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks