General

  • Target

    TBKK E12101010.xlsx

  • Size

    2.3MB

  • Sample

    210121-cdaefczbj2

  • MD5

    f1cf541ccab20355894500b07989f613

  • SHA1

    cc304fa51a202db65b6d328efb94475aae2783b2

  • SHA256

    1af443c2ce9686c76e7e42d421e42556f843b04fc683517be220191b8062c457

  • SHA512

    875ebe34c80daa5be2c81fe4da7674b0912ad8595679f2ea6b79abcc18e0adea4188d294f986bb13c7fc50a13dcda9d63dfe5c6bd41e6cdb756a78dca34e8a87

Malware Config

Extracted

Family

formbook

C2

http://www.stonescapes1.com/de92/

Decoy

zindaginews.com

tyelevator.com

schustermaninterests.com

algemixdelchef.com

doubscollectivites.com

e-butchery.com

hellbentmask.com

jumbpprivacy.com

teeniestiedye.com

playfulartwork.com

desertvacahs.com

w5470-hed.net

nepalearningpods.com

smoothandsleek.com

thecannaglow.com

torrentkittyla.com

industrytoyou.com

raquelvargas.net

rlc-nc.net

cryptoprises.com

Targets

    • Target

      TBKK E12101010.xlsx

    • Size

      2.3MB

    • MD5

      f1cf541ccab20355894500b07989f613

    • SHA1

      cc304fa51a202db65b6d328efb94475aae2783b2

    • SHA256

      1af443c2ce9686c76e7e42d421e42556f843b04fc683517be220191b8062c457

    • SHA512

      875ebe34c80daa5be2c81fe4da7674b0912ad8595679f2ea6b79abcc18e0adea4188d294f986bb13c7fc50a13dcda9d63dfe5c6bd41e6cdb756a78dca34e8a87

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks