General

  • Target

    fadb21a70ab5923cbe8e8deeb36af5e07efd0e87.xls

  • Size

    37KB

  • Sample

    210507-7wxechntj6

  • MD5

    abc73f6301b9f828dce46943b7111f29

  • SHA1

    fadb21a70ab5923cbe8e8deeb36af5e07efd0e87

  • SHA256

    ac0ccf59d64faf079e0d4e93ec994865214aefd0899f644da81f8e748e4ee153

  • SHA512

    00f1499e6db64cf9bc94bba3a90382f5b045a3e291e65ef8db68a916cf586353d48ac7509c30c14c0da1b1557ac96ba60cf2a5214321395892473634dc56b813

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.craftsman-vail.com/cca/

Decoy

whenpigsflyhigh.com

artistiklounge.com

tinytrendstique.com

projektpartner-ag.com

charvelevh.com

easycompliances.net

zengheqiye.com

professionalmallorca.com

bonzerstudio.com

nelivo.com

yangxeric.com

aredntech.com

twincitieshousingmarket.com

allshadesunscreen.com

xiang-life.net

qmcp00011.com

lindsayeandmarkv.com

fbcsbvsbvsjbvjs.com

saveonthrivelife.com

newdpo.com

Targets

    • Target

      fadb21a70ab5923cbe8e8deeb36af5e07efd0e87.xls

    • Size

      37KB

    • MD5

      abc73f6301b9f828dce46943b7111f29

    • SHA1

      fadb21a70ab5923cbe8e8deeb36af5e07efd0e87

    • SHA256

      ac0ccf59d64faf079e0d4e93ec994865214aefd0899f644da81f8e748e4ee153

    • SHA512

      00f1499e6db64cf9bc94bba3a90382f5b045a3e291e65ef8db68a916cf586353d48ac7509c30c14c0da1b1557ac96ba60cf2a5214321395892473634dc56b813

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Formbook Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Use of msiexec (install) with remote resource

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

4
T1082

Tasks