General

  • Target

    Payment Swift.doc

  • Size

    376KB

  • Sample

    210504-zbst85bt62

  • MD5

    c8080fbfc825b01f11973566f1a3e589

  • SHA1

    9aa04e64414bef6504b211615f7fcdbe84cd75df

  • SHA256

    af801e43101c06e3366d942715a8b10f90f12ec3437cab1b8a0cc3872101eebe

  • SHA512

    90775d8a921c9b094bbd1bb4bd20e11f997d70ad1f465fdfae6459cbb7e311116e434908caacf4b7844229d9835134180f549cd5d95e42a8305f98860fd23ce6

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.shoprodeovegas.com/xcl/

Decoy

sewingtherose.com

thesmartshareholder.com

afasyah.com

marolamusic.com

lookupgeorgina.com

plataforyou.com

dijcan.com

pawtyparcels.com

interprediction.com

fairerfinancehackathon.net

thehmnshop.com

jocelynlopez.com

launcheffecthouston.com

joyeveryminute.com

spyforu.com

ronerasanjuan.com

gadgetsdesi.com

nmrconsultants.com

travellpod.com

ballparksportscards.com

Targets

    • Target

      Payment Swift.doc

    • Size

      376KB

    • MD5

      c8080fbfc825b01f11973566f1a3e589

    • SHA1

      9aa04e64414bef6504b211615f7fcdbe84cd75df

    • SHA256

      af801e43101c06e3366d942715a8b10f90f12ec3437cab1b8a0cc3872101eebe

    • SHA512

      90775d8a921c9b094bbd1bb4bd20e11f997d70ad1f465fdfae6459cbb7e311116e434908caacf4b7844229d9835134180f549cd5d95e42a8305f98860fd23ce6

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks