General

  • Target

    Soa.doc

  • Size

    512KB

  • Sample

    210119-s9k6y3w9ms

  • MD5

    c8d6f663f18deded129dcd09717fac93

  • SHA1

    d9693e9110dcb432447fa12d3e5d3a5e830a4984

  • SHA256

    ff04de070992e03856e6f04a66c1fb8c0861c5e655eb13e8c0c1d266c73ea501

  • SHA512

    eb2e2f252b891a75a3ae4e320c1059a07c06b5e3c4a39321211c9b9c0fe694f66f3c411a2a4799d712aa688e35f4f6a066b1ec4fa94626c70f52175578511be6

Malware Config

Extracted

Family

formbook

C2

http://www.unitedfootballcamps.com/bf3/

Decoy

ecatcom.com

what3emoji.com

primbathandbody.com

yt-itclub.com

newbieeer.com

getyoursofa.com

mexicanitems.info

catalogcardgames.net

leagueofwomengolfers.com

gvanmp.com

midnightsunhi.com

cnluma.com

sunsetcherrydesigns.com

cosmoproturkey.com

inifinityapps.net

making50masks.com

battalionice.com

uk-calculation.net

frosteatlove.com

bs-mag.com

Targets

    • Target

      Soa.doc

    • Size

      512KB

    • MD5

      c8d6f663f18deded129dcd09717fac93

    • SHA1

      d9693e9110dcb432447fa12d3e5d3a5e830a4984

    • SHA256

      ff04de070992e03856e6f04a66c1fb8c0861c5e655eb13e8c0c1d266c73ea501

    • SHA512

      eb2e2f252b891a75a3ae4e320c1059a07c06b5e3c4a39321211c9b9c0fe694f66f3c411a2a4799d712aa688e35f4f6a066b1ec4fa94626c70f52175578511be6

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks