Overview

overview

10

Static

static

SMC INQUIRY.doc

windows7_x64

10

SMC INQUIRY.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SMC INQUIRY.doc

  • Size

    1.6MB

  • Sample

    211103-xvx86seec8

  • MD5

    c3f435c1711eb57e13acd2cb1fdf04a2

  • SHA1

    a4cedd66c27cf1aaed9ebf9fc0deb1f82dc937c3

  • SHA256

    88d6f042585c2e129d891c4bb6217544c7d8cc2a814d4bb61cd7359165e4af84

  • SHA512

    680adaff375d64c034eba36bd73cbcfc34978fb3fca660e2d6d2d8ab3809f24fb036f747d328c1d95f15b02c68df95b161950820e559b28e27fecb6d5cdbad8e

Score
10/10
formbooks18yratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

C2

http://www.agentpathleurre.space/s18y/

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Targets

    • Target

      SMC INQUIRY.doc

    • Size

      1.6MB

    • MD5

      c3f435c1711eb57e13acd2cb1fdf04a2

    • SHA1

      a4cedd66c27cf1aaed9ebf9fc0deb1f82dc937c3

    • SHA256

      88d6f042585c2e129d891c4bb6217544c7d8cc2a814d4bb61cd7359165e4af84

    • SHA512

      680adaff375d64c034eba36bd73cbcfc34978fb3fca660e2d6d2d8ab3809f24fb036f747d328c1d95f15b02c68df95b161950820e559b28e27fecb6d5cdbad8e

    Score
    10/10
    formbooks18yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks