General

  • Target
    Material Requisition for Quotation (MRQ).exe
  • Size 222KB
  • Sample210414-7dbx9rf7ra
  • SHA256 8f6fcbc62fb32a19196119ccaa6e45a5eabb8ed2aad233e5ea910dd3e6bde421
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.tiktokblueprints.com/ea9e/

Decoy
  • yoga-fertilite.com

  • zcltlfsh.icu

  • aberdareroyalcottages.com

  • kawaiibobateahouse.com

  • 311gang.com

  • coastalbreezecreations.com

  • globosimpresoss.com

  • ignitioniq.com

  • 5gplaystation.com

  • marketopiniononline.com

  • martinstantondesigns.com

  • ksdhxtkpup4.net

  • findconscious.com

  • pure-tab.com

  • orderanthonysofskippack.com

  • findingthecurve.com

  • e-devletim.com

  • prosystemwebsite.com

  • travelbroom.com

  • sharpopinion.com

Targets

    • Target
      Material Requisition for Quotation (MRQ).exe
    • Size 222KB
    • SHA256 8f6fcbc62fb32a19196119ccaa6e45a5eabb8ed2aad233e5ea910dd3e6bde421
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks