Overview

overview

10

Static

static

TT Payment...0.xlsx

windows7_x64

10

TT Payment...0.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TT Payment - 105,272.40.xlsx

  • Size

    1.9MB

  • Sample

    210118-tnfwrpbe3n

  • MD5

    eaeea812b9d9bcb9aa3373449e869411

  • SHA1

    4da441a80229eb466c232a0a1d05aa5a0cf7ea21

  • SHA256

    9f505c683b52a195879f9836e49009f89ea1caa957327edad4b79316f72540c9

  • SHA512

    d5806799f7c84a570d39ec82077b4bd2f2286d9a98e4515aa20e4b4faf91b23b1e489aa1db4ce1739ca463ce7fa1b16da7064e7d06e8fde212fb5e95c1eaae7d

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.bytecommunication.com/aky/

Decoy

jeiksaoeklea.com

sagame-auto.net

soloseriolavoro.com

thecreatorsbook.com

superskritch.com

oroxequipment.com

heart-of-art.online

liwedfg.com

fisherofsouls.com

jota.xyz

nehyam.com

smart-contact-delivery.com

hoom.guru

dgryds.com

thesoakcpd.com

mishv.com

rings-factory.info

bero-craft-beers.com

podcastnamegenerators.com

856379813.xyz

Targets

    • Target

      TT Payment - 105,272.40.xlsx

    • Size

      1.9MB

    • MD5

      eaeea812b9d9bcb9aa3373449e869411

    • SHA1

      4da441a80229eb466c232a0a1d05aa5a0cf7ea21

    • SHA256

      9f505c683b52a195879f9836e49009f89ea1caa957327edad4b79316f72540c9

    • SHA512

      d5806799f7c84a570d39ec82077b4bd2f2286d9a98e4515aa20e4b4faf91b23b1e489aa1db4ce1739ca463ce7fa1b16da7064e7d06e8fde212fb5e95c1eaae7d

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks