General

  • Target

    PAYMENTADVICE.xlsx

  • Size

    2.3MB

  • Sample

    210226-tfp4hg4kh2

  • MD5

    6a665d2ebffb301cd53b051cf04337b3

  • SHA1

    74b35d94beacfe37f41cc6891e7ddc96a442c0bd

  • SHA256

    08a0ab3c46df8c30ed29ab0ab4d5cc733c421cbff42490788a34f5aba13bb37b

  • SHA512

    8b19d0ffa2315b8ff74eece86ab92bc417523867291589700cf086f6a3aa0199e119fcd55a04d05e007a15bdfaceeeab6a31c1906d7bd8ca37c50fdcaea6ecae

Malware Config

Extracted

Family

formbook

C2

http://www.torontotel.com/4qdc/

Decoy

mangpe.asia

mmstruckingllc.com

ascendingworship.com

gfeets.com

smartcbda.com

dreaminggrand.com

dohostar.com

farkindalik365.com

weareexpatwomen.com

gamereruns.com

rosesandframes.com

commagx4.info

tarpleymusic.info

szttskj.com

calatheahomeservices.com

qm7886.com

emunmous.com

deutschclub.com

39palmavenue.com

thepixxelgroup.com

Targets

    • Target

      PAYMENTADVICE.xlsx

    • Size

      2.3MB

    • MD5

      6a665d2ebffb301cd53b051cf04337b3

    • SHA1

      74b35d94beacfe37f41cc6891e7ddc96a442c0bd

    • SHA256

      08a0ab3c46df8c30ed29ab0ab4d5cc733c421cbff42490788a34f5aba13bb37b

    • SHA512

      8b19d0ffa2315b8ff74eece86ab92bc417523867291589700cf086f6a3aa0199e119fcd55a04d05e007a15bdfaceeeab6a31c1906d7bd8ca37c50fdcaea6ecae

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks