Overview

overview

10

Static

static

8

814e1a31a6...fc.xls

windows7_x64

10

814e1a31a6...fc.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    814e1a31a6bff8df45a6393430e9c0b7bbaddafc

  • Size

    37KB

  • Sample

    210507-gebvgerlwa

  • MD5

    ccaacde2a2fea467aacb4d46c0f6d92a

  • SHA1

    814e1a31a6bff8df45a6393430e9c0b7bbaddafc

  • SHA256

    c2c6534ff0fbb2099535e54323aec998d82de2811f6fd82337927c9d866e01f4

  • SHA512

    6592b22bb684fa3a47f33f666c6a3af666b59052adbce1088dfa9031b1f862328ba3d533f03abd3e47fe34d5d05db2873feeec8dae7d08c23bc88cb51b4c19ee

Score
10/10
formbookmacroratspywarestealertrojanxlm

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.111bjs.com/ccr/

Decoy

abdullahlodhi.com

jevya.com

knoxvillerestaurant.com

mekarauroko7389.com

cricketspowder.net

johannchirinos.com

orangeorganical.com

libero-tt.com

lorenaegianluca.com

wintab.net

modernmillievintage.com

zgdqcyw.com

jeffabildgaardmd.com

nurulfikrimakassar.com

findyourchef.com

innovationsservicegroup.com

destek-taleplerimiz.com

whfqqco.icu

kosmetikmadeingermany.com

dieteticos.net

Targets

    • Target

      814e1a31a6bff8df45a6393430e9c0b7bbaddafc

    • Size

      37KB

    • MD5

      ccaacde2a2fea467aacb4d46c0f6d92a

    • SHA1

      814e1a31a6bff8df45a6393430e9c0b7bbaddafc

    • SHA256

      c2c6534ff0fbb2099535e54323aec998d82de2811f6fd82337927c9d866e01f4

    • SHA512

      6592b22bb684fa3a47f33f666c6a3af666b59052adbce1088dfa9031b1f862328ba3d533f03abd3e47fe34d5d05db2873feeec8dae7d08c23bc88cb51b4c19ee

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Use of msiexec (install) with remote resource

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks