General

  • Target

    Inquiry PR11020204168.xlsx

  • Size

    2.5MB

  • Sample

    210121-xw98g42x4s

  • MD5

    abcb38dee6d515f3e5b7c6bdbc179e84

  • SHA1

    043024ce517bc4cd801103fe1fe7402f5c5e16f3

  • SHA256

    9975a71837159cdfdf2dfd0a38a62ff8f8e90ada6e6a18e63cf143d861964d49

  • SHA512

    fc55de5624d9a4c57bf553061710aef07f2f92a54785ae0002040c849967d9fadc4ce8cde0aaa37bba21884d33b3854d26d92ce3a0edd1e726d04382a646fd4c

Malware Config

Extracted

Family

formbook

C2

http://www.learnhour.net/eaud/

Decoy

modshiro.com

mademarketingoss.com

austinjourls.info

wayupteam.com

crossingfinger.com

interseptors.com

gigashit.com

livetigo.com

halamankuningindonesia.com

windhammills.com

aylinahmet.com

mbacexonan.website

shopboxbarcelona.com

youyeslive.com

coonlinesportsbooks.com

guorunme.com

putlocker2.site

pencueaidnetwork.com

likevector.com

vulcanudachi-proclub.com

Targets

    • Target

      Inquiry PR11020204168.xlsx

    • Size

      2.5MB

    • MD5

      abcb38dee6d515f3e5b7c6bdbc179e84

    • SHA1

      043024ce517bc4cd801103fe1fe7402f5c5e16f3

    • SHA256

      9975a71837159cdfdf2dfd0a38a62ff8f8e90ada6e6a18e63cf143d861964d49

    • SHA512

      fc55de5624d9a4c57bf553061710aef07f2f92a54785ae0002040c849967d9fadc4ce8cde0aaa37bba21884d33b3854d26d92ce3a0edd1e726d04382a646fd4c

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks