General

  • Target

    IMG_010357.doc

  • Size

    784KB

  • Sample

    210119-nd16tsf58e

  • MD5

    802a08275e329d68836ba4d9afe7d9ab

  • SHA1

    248f795f372cb4ed8ccd3385c976131e8b31598e

  • SHA256

    0a07a25107fbbaede9d4fd47e306e666fd8694535e4ca6da79d7e33569efb52e

  • SHA512

    4c81b299d081ee0ac28e0ac99989c0bbb7a20de3dc660a1f91ffd86ae785a3a98ce73a25c4f0ab304def3c514d3a893de82e71c05634ab874b51cd45f32b92ea

Malware Config

Extracted

Family

formbook

C2

http://www.vitajwb.com/irux/

Decoy

heteltht.com

transbordaquemultiplica.com

ispartakulecleaner.com

woodcutter.website

gy88api8888.com

forsagemagic.com

greenqobbler.com

piligame.com

pcbet333.com

superpuzzlegames.com

jameslearyrealestate.com

acmarketinghacks.com

world-travel.xyz

sprayfoampocatello.com

anshangbao.com

qacpilotacademy.com

aodaicali.com

aarusystems.com

potion-designs.com

bajaenvocho.com

Targets

    • Target

      IMG_010357.doc

    • Size

      784KB

    • MD5

      802a08275e329d68836ba4d9afe7d9ab

    • SHA1

      248f795f372cb4ed8ccd3385c976131e8b31598e

    • SHA256

      0a07a25107fbbaede9d4fd47e306e666fd8694535e4ca6da79d7e33569efb52e

    • SHA512

      4c81b299d081ee0ac28e0ac99989c0bbb7a20de3dc660a1f91ffd86ae785a3a98ce73a25c4f0ab304def3c514d3a893de82e71c05634ab874b51cd45f32b92ea

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks