Overview

overview

10

Static

static

Neue Bestellung.xlsx

windows7_x64

10

Neue Bestellung.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Neue Bestellung.xlsx

  • Size

    228KB

  • Sample

    211118-kz2e6scbcr

  • MD5

    6e8ba3eb00c3d87afbc75d11251f35fb

  • SHA1

    0cbd4717f1dffdc91e85c38a2aabffb95a60c7ba

  • SHA256

    020c9745a66a8b2fd17bbe68f1c25f3c15377a3da0c9759be9bfc584feadb842

  • SHA512

    1af8c2f71b68c89f3edcc2961e426c5e5dca54de39e59dad2e53a693dbdb011deb623de9814ff043e317aa2766fd365a97886048e18502538250a1eeb70c939c

Score
10/10
formbook9gr5ratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

9gr5

C2

http://www.cuteprofessionalscrubs.com/9gr5/

Decoy

newleafcosmetix.com

richermanscastle.com

ru-remonton.com

2diandongche.com

federaldados.design

jeffreycookweb.com

facecs.online

xmeclarn.xyz

olgasmith.xyz

sneakersonlinesale.com

playboyshiba.com

angelamiglioli.com

diitaldefynd.com

whenevergames.com

mtheartcustom.com

vitalactivesupply.com

twistblogr.com

xn--i8s140at3d6u7c.tel

baudelaireelhakim.com

real-estate-miami-searcher.site

Targets

    • Target

      Neue Bestellung.xlsx

    • Size

      228KB

    • MD5

      6e8ba3eb00c3d87afbc75d11251f35fb

    • SHA1

      0cbd4717f1dffdc91e85c38a2aabffb95a60c7ba

    • SHA256

      020c9745a66a8b2fd17bbe68f1c25f3c15377a3da0c9759be9bfc584feadb842

    • SHA512

      1af8c2f71b68c89f3edcc2961e426c5e5dca54de39e59dad2e53a693dbdb011deb623de9814ff043e317aa2766fd365a97886048e18502538250a1eeb70c939c

    Score
    10/10
    formbook9gr5ratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks