General

  • Target

    Inquiry 05042021.doc

  • Size

    374KB

  • Sample

    210503-pjh6fx4csj

  • MD5

    e9260ff7bb6e35d8fa72e725c017b6bd

  • SHA1

    78f98dfacba3e97edc359934ed96733c28ae9ecb

  • SHA256

    37d7aa935abf410814d084177c16b5a7a6353e18ef72749187bd1b5bb343da9d

  • SHA512

    08c3fc0e6f6b7d3e6d3a811ec3e31b749acd3c7f125a98030ba3672e12f4b1a51f018b9290172a8ab6aece9529844e40625c2184de326120213b786f6541655a

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.shoprodeovegas.com/xcl/

Decoy

sewingtherose.com

thesmartshareholder.com

afasyah.com

marolamusic.com

lookupgeorgina.com

plataforyou.com

dijcan.com

pawtyparcels.com

interprediction.com

fairerfinancehackathon.net

thehmnshop.com

jocelynlopez.com

launcheffecthouston.com

joyeveryminute.com

spyforu.com

ronerasanjuan.com

gadgetsdesi.com

nmrconsultants.com

travellpod.com

ballparksportscards.com

Targets

    • Target

      Inquiry 05042021.doc

    • Size

      374KB

    • MD5

      e9260ff7bb6e35d8fa72e725c017b6bd

    • SHA1

      78f98dfacba3e97edc359934ed96733c28ae9ecb

    • SHA256

      37d7aa935abf410814d084177c16b5a7a6353e18ef72749187bd1b5bb343da9d

    • SHA512

      08c3fc0e6f6b7d3e6d3a811ec3e31b749acd3c7f125a98030ba3672e12f4b1a51f018b9290172a8ab6aece9529844e40625c2184de326120213b786f6541655a

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks