General

  • Target

    Evaluation quoter.docx

  • Size

    10KB

  • Sample

    210427-gvn4zn73zs

  • MD5

    2c30e2c8829b2dce3aeebe20182b7be4

  • SHA1

    9ce579b42d60563fcb85f6e2e9d7aa32a985d386

  • SHA256

    ea6f660d6c4499c7a446ac3bfde1cd02bd74dfe9194fd16e5c876d5c38ff56ca

  • SHA512

    a62f890137a55f5c38085272475028f6510ee3f2717a638861a94ef7d2d3c8b2c7511080413bd6ad804015139b0d77765000d75276f5b99a36ad8a0dd3df3581

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

https://is.gd/EAkEcx

Extracted

Family

formbook

Version

4.1

C2

http://www.unclechef.website/pmc/

Decoy

poolbuilderhighlandpark.com

zgqcmrdswlw.com

rivalrepublic.net

vowseries.com

papmbeachcountymusic.com

unitedmarguisa.com

sparetimr.net

mmmfccynp.icu

blossom123.com

rkd6.com

luewhhedre.com

rwproducedeliveryknoxville.com

bqg5000.com

xn--jvrr98g37n88d.com

15slotozlo.site

experthairstylist.site

udalastar.com

avenstoredetailing.com

americanmicron.com

fineprintlaw.com

Targets

    • Target

      Evaluation quoter.docx

    • Size

      10KB

    • MD5

      2c30e2c8829b2dce3aeebe20182b7be4

    • SHA1

      9ce579b42d60563fcb85f6e2e9d7aa32a985d386

    • SHA256

      ea6f660d6c4499c7a446ac3bfde1cd02bd74dfe9194fd16e5c876d5c38ff56ca

    • SHA512

      a62f890137a55f5c38085272475028f6510ee3f2717a638861a94ef7d2d3c8b2c7511080413bd6ad804015139b0d77765000d75276f5b99a36ad8a0dd3df3581

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Abuses OpenXML format to download file from external location

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks