General

  • Target
    AWB 224000318400 - 224000318040.exe
  • Size 229KB
  • Sample210601-4dn9fv112x
  • SHA256 d3b19cf0506617e6ac964656ebfe51f1c3066337b66bfdb48bd31b44ff61e7fb
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

C2
  • http://www.updatesz.com/hlx/

Decoy
  • firo.store

  • unmeasured-grace.com

  • burger-ff.com

  • alcargomoversllc.com

  • brianratkevich.com

  • semugaralara01.net

  • ngalvision.com

  • texaslearningpods.com

  • ontarioboatcharters.com

  • kleinrugcleaning.com

  • michaelvancebromfield.com

  • habitameya.com

  • elyoma.com

  • worldtvepisode.com

  • masatakahorie.com

  • jumpinginfo.com

  • hfjxhs.com

  • bf-swiss.com

  • rvingbus.com

  • suxfi.com

Targets

    • Target
      AWB 224000318400 - 224000318040.exe
    • Size 229KB
    • SHA256 d3b19cf0506617e6ac964656ebfe51f1c3066337b66bfdb48bd31b44ff61e7fb
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks