General

  • Target

    Biomed quotation.xlsx

  • Size

    461KB

  • Sample

    210421-h9s64qky7s

  • MD5

    cede2983cf919e588ecdaaa897ee843f

  • SHA1

    4a17802328d5df28a50aa70dded5450ff9fe0107

  • SHA256

    50a0ad7b25ca559bc2d753a6b5c7bcdc91d362977f3169f9d344ceef9e7c1cf8

  • SHA512

    861701a236cd9d6f39351bc65f343b262966fbce5b9363cb9ae5bde8673aeb58396f1c08ac4c9fd32728cc1453064c4eaa7b1bb3e957896e6cc213fa1650b422

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.kelurahanpatikidul.xyz/op9s/

Decoy

playsystems-j.one

exchange.digital

usaleadsretrieval.com

mervegulistanaydin.com

heavythreadclothing.com

attorneyperu.com

lamuerteesdulce.com

catxirulo.com

willowrunconnemaras.com

laospecial.com

anchotrading.com

mycreditebook.com

jiujiu.plus

juniperconsulting.site

millionairsmindset.com

coronaviruscuredrugs.com

services-office.com

escanaim.com

20svip.com

pistonpounder.com

Targets

    • Target

      Biomed quotation.xlsx

    • Size

      461KB

    • MD5

      cede2983cf919e588ecdaaa897ee843f

    • SHA1

      4a17802328d5df28a50aa70dded5450ff9fe0107

    • SHA256

      50a0ad7b25ca559bc2d753a6b5c7bcdc91d362977f3169f9d344ceef9e7c1cf8

    • SHA512

      861701a236cd9d6f39351bc65f343b262966fbce5b9363cb9ae5bde8673aeb58396f1c08ac4c9fd32728cc1453064c4eaa7b1bb3e957896e6cc213fa1650b422

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks