General

  • Target

    Ordine di acquisto GM004868.doc

  • Size

    572KB

  • Sample

    210420-6qp2sqdlc2

  • MD5

    8e76e36ecd9c1cf7815a895060b1faf8

  • SHA1

    808b8c09768912bd4305904d4919489c98b75ed0

  • SHA256

    0ed349a732a4c26e6d9fd8d7311239bf86dc676a77ea6fe73c58a676373814a0

  • SHA512

    d7348b89c470dfad0a44b5f44c50760eb835f9bec3d865a79ff1c60e0723f7aadc3c3341819b554833cd7a3b9d8429e691c6458b232a8f698e05bc83d8f46eed

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.shoprodeovegas.com/xcl/

Decoy

sewingtherose.com

thesmartshareholder.com

afasyah.com

marolamusic.com

lookupgeorgina.com

plataforyou.com

dijcan.com

pawtyparcels.com

interprediction.com

fairerfinancehackathon.net

thehmnshop.com

jocelynlopez.com

launcheffecthouston.com

joyeveryminute.com

spyforu.com

ronerasanjuan.com

gadgetsdesi.com

nmrconsultants.com

travellpod.com

ballparksportscards.com

Targets

    • Target

      Ordine di acquisto GM004868.doc

    • Size

      572KB

    • MD5

      8e76e36ecd9c1cf7815a895060b1faf8

    • SHA1

      808b8c09768912bd4305904d4919489c98b75ed0

    • SHA256

      0ed349a732a4c26e6d9fd8d7311239bf86dc676a77ea6fe73c58a676373814a0

    • SHA512

      d7348b89c470dfad0a44b5f44c50760eb835f9bec3d865a79ff1c60e0723f7aadc3c3341819b554833cd7a3b9d8429e691c6458b232a8f698e05bc83d8f46eed

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks