General

  • Target

    Ordine di acquisto 200421.doc

  • Size

    635KB

  • Sample

    210421-27fxnjtjp2

  • MD5

    2d7a434b986c29f53e6b78b2c13c6589

  • SHA1

    34d24e17b76c7092ea363c408870f6d075d5b70b

  • SHA256

    c45b33aef7f1099da1d1bf669f1082b3cf4d3bbe9e79a98a254b861d264fb143

  • SHA512

    ddc46d7a4d0376b32e30d9601ee91b9bf9a45bb8021d47015dafa4d4254a7d6565bfa505511510eca7d31c08740d24066ae5d6c6d66df0e23d5de1172f81a346

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.shoprodeovegas.com/xcl/

Decoy

sewingtherose.com

thesmartshareholder.com

afasyah.com

marolamusic.com

lookupgeorgina.com

plataforyou.com

dijcan.com

pawtyparcels.com

interprediction.com

fairerfinancehackathon.net

thehmnshop.com

jocelynlopez.com

launcheffecthouston.com

joyeveryminute.com

spyforu.com

ronerasanjuan.com

gadgetsdesi.com

nmrconsultants.com

travellpod.com

ballparksportscards.com

Targets

    • Target

      Ordine di acquisto 200421.doc

    • Size

      635KB

    • MD5

      2d7a434b986c29f53e6b78b2c13c6589

    • SHA1

      34d24e17b76c7092ea363c408870f6d075d5b70b

    • SHA256

      c45b33aef7f1099da1d1bf669f1082b3cf4d3bbe9e79a98a254b861d264fb143

    • SHA512

      ddc46d7a4d0376b32e30d9601ee91b9bf9a45bb8021d47015dafa4d4254a7d6565bfa505511510eca7d31c08740d24066ae5d6c6d66df0e23d5de1172f81a346

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks