Overview

overview

10

Static

static

Payment Co...on.doc

windows7_x64

10

Payment Co...on.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment Confirmation.doc

  • Size

    57KB

  • Sample

    210723-jvq3fjy6ca

  • MD5

    88b8c238ca748c1b5c056364acac3336

  • SHA1

    cf99d9a1d8252b87797124561a08d35a4f254946

  • SHA256

    769f5f59dbd758fbad94b0b7fb84afd003f87b00e5991a239ecd562c51ee991f

  • SHA512

    26b850ab74da2cae5739d67d277b73db1e9a0cc48b4cfb3442465de0004212735012e74ede837d763112718853abe3b513358a3de9e6e7fd86cf2d9d18058c84

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.meilleurspromo.com/lmsa/

Decoy

functionalkitchen.net

jiangxichuangke.com

lonerkont.space

champcarfanatics.com

csillag-szuletik.info

jupitowatch.com

lmcomputer.net

alfawize.com

mouthconsults.com

gruppolarta.com

gaymyway.com

bostonpeach.com

bioclean.pro

thingsandotherstuff.com

gencmetals.com

cwivf.com

nbhgddfgggnhhmhln.com

myscoutinglife.com

ccubk.com

cheapfloatingrentals.com

Targets

    • Target

      Payment Confirmation.doc

    • Size

      57KB

    • MD5

      88b8c238ca748c1b5c056364acac3336

    • SHA1

      cf99d9a1d8252b87797124561a08d35a4f254946

    • SHA256

      769f5f59dbd758fbad94b0b7fb84afd003f87b00e5991a239ecd562c51ee991f

    • SHA512

      26b850ab74da2cae5739d67d277b73db1e9a0cc48b4cfb3442465de0004212735012e74ede837d763112718853abe3b513358a3de9e6e7fd86cf2d9d18058c84

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks