Overview

overview

10

Static

static

Request fo...oc.rtf

windows7_x64

10

Request fo...oc.rtf

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request for New Quote - Valve Ist Order.doc

  • Size

    318KB

  • Sample

    210430-ctxrj2x4te

  • MD5

    7d80d39f97a6e35dfc339a44d4b76d5c

  • SHA1

    c3dc95cd79dbdac0012105f4eab82633f5261f66

  • SHA256

    13340714da4aa2f3934591b6e845db59a99dbfbfcd948b96332e64378057453c

  • SHA512

    762911be3b0669a521a3b4f12609d7d4a711dc5e8ace2ef3e1395bd9d4688d7fadc84a91c2f4373c7098b7175b2c7382ad9d969ab4f51e85b6b37fe281a3b12e

Score
10/10
formbookagilenetratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.semenovdmitriik.club/bwk/

Decoy

alexrabus.com

education618.com

nelivo.com

gosanispire.com

cdaboozecruise.com

lovenfys.com

wellsleyarts.com

madcord.net

aadiventura.com

prideglobalholdings.com

tu-aviso.com

rjroof.com

upthehilldogwalking.com

ultraletefit.com

opinetree.com

retiredalsolovingit.com

oculensweb.com

laurartproductions.com

uncontenido.com

elisabethchin.com

Targets

    • Target

      Request for New Quote - Valve Ist Order.doc

    • Size

      318KB

    • MD5

      7d80d39f97a6e35dfc339a44d4b76d5c

    • SHA1

      c3dc95cd79dbdac0012105f4eab82633f5261f66

    • SHA256

      13340714da4aa2f3934591b6e845db59a99dbfbfcd948b96332e64378057453c

    • SHA512

      762911be3b0669a521a3b4f12609d7d4a711dc5e8ace2ef3e1395bd9d4688d7fadc84a91c2f4373c7098b7175b2c7382ad9d969ab4f51e85b6b37fe281a3b12e

    Score
    10/10
    formbookagilenetratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks