General

  • Target

    Swift Copy MT103.docx

  • Size

    10KB

  • Sample

    210621-r2p3xgneaa

  • MD5

    0af91d7b71322d26388ca7514ac04ec9

  • SHA1

    1589484b4e088060c6d98be0f0722b1073ed5519

  • SHA256

    4ff4f1d31926b86bc3d8bcdb13a445ec7637edd9f4ae48c153262a713c1f72b0

  • SHA512

    f60f19dabde1702615224fa46f992aad77b5e8b3bb5c4a34c826a4bfc8b9f8ca4818820c3926a4094675487f2de842975b7211a649e07fca3ee56464839b79ba

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

https://win32indexdummy_username@itsssl.com/JmQEk

Extracted

Family

formbook

Version

4.1

C2

http://www.dragonpalcenk.com/k8n/

Decoy

foxynailserie.com

thenoyzees.com

waterrising.xyz

allmister.com

theguyscave.com

erkitap.com

spyder-club.com

raskrutisam.com

giantledlights.com

wowbeautynails.com

youmovies.site

abjms.com

enso-solutions.com

seasonalcampgroundsmn.com

lukeprater.com

mufasacapital.com

idi360.com

mask-cleaner.com

aeruswilmde.com

venkatlifecoach.com

Targets

    • Target

      Swift Copy MT103.docx

    • Size

      10KB

    • MD5

      0af91d7b71322d26388ca7514ac04ec9

    • SHA1

      1589484b4e088060c6d98be0f0722b1073ed5519

    • SHA256

      4ff4f1d31926b86bc3d8bcdb13a445ec7637edd9f4ae48c153262a713c1f72b0

    • SHA512

      f60f19dabde1702615224fa46f992aad77b5e8b3bb5c4a34c826a4bfc8b9f8ca4818820c3926a4094675487f2de842975b7211a649e07fca3ee56464839b79ba

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Abuses OpenXML format to download file from external location

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks