General

  • Target

    PRICE QUOTATION.doc

  • Size

    203KB

  • Sample

    211022-a4ervsbhdl

  • MD5

    c5f1c52134fc41ecb171c89602e937a4

  • SHA1

    18567677d3724c4115fb27d16e0589e5982fc173

  • SHA256

    d5875fb3d39a9ec2781084bf80ad62c21371f6aa38d6f55919572f6a37ed6568

  • SHA512

    b2ea93ea3cff14b54fd384a44ed41f183ab42d9b8b2091f43f04055c24bd0fa28fb15f68503a2758b21850d560ef62207e9d25dc8adfece25ce944da57bcf3b0

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

C2

http://www.agentpathleurre.space/s18y/

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Targets

    • Target

      PRICE QUOTATION.doc

    • Size

      203KB

    • MD5

      c5f1c52134fc41ecb171c89602e937a4

    • SHA1

      18567677d3724c4115fb27d16e0589e5982fc173

    • SHA256

      d5875fb3d39a9ec2781084bf80ad62c21371f6aa38d6f55919572f6a37ed6568

    • SHA512

      b2ea93ea3cff14b54fd384a44ed41f183ab42d9b8b2091f43f04055c24bd0fa28fb15f68503a2758b21850d560ef62207e9d25dc8adfece25ce944da57bcf3b0

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks