Overview

overview

10

Static

static

TT Slip.doc.rtf

windows7_x64

10

TT Slip.doc.rtf

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TT Slip.doc

  • Size

    1.5MB

  • Sample

    210119-2f8jsf1l4e

  • MD5

    1346939d66aaba35fc0b1038500acb57

  • SHA1

    069163a5437a681d36bd28db647a3e09cc3c843f

  • SHA256

    edff50baf76f61fd72952a9b613757729994ef745773d7b7ad67f352c302873d

  • SHA512

    aa2df1c8216dea9b33044f9b06c7239d61ce9cde3ffe2a6399c5b4c02ad5603bdc4418e3c2630509e7ef19d884a66153cbbb4051633226684d9b52a7a8fdf6ac

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.transparentpetcrate.com/lnb/

Decoy

sauschwein.info

ywpntv.com

gironbeautysalon.online

cryptogeekstuff.com

leosrock.com

sistersv.space

ilss.life

vshuzi.com

europeanculinarymagic.com

mdtlalab.com

boletasenorden.com

eebushe11.com

sms8888.com

arrogantjerxs.com

aboudmotors.com

vzuels.com

searko.com

thathealthysoul.com

365wt38493984284.com

solarpanelsystemflorida.com

Targets

    • Target

      TT Slip.doc

    • Size

      1.5MB

    • MD5

      1346939d66aaba35fc0b1038500acb57

    • SHA1

      069163a5437a681d36bd28db647a3e09cc3c843f

    • SHA256

      edff50baf76f61fd72952a9b613757729994ef745773d7b7ad67f352c302873d

    • SHA512

      aa2df1c8216dea9b33044f9b06c7239d61ce9cde3ffe2a6399c5b4c02ad5603bdc4418e3c2630509e7ef19d884a66153cbbb4051633226684d9b52a7a8fdf6ac

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks