Overview

overview

10

Static

static

AccountSta...1.xlsx

windows7_x64

10

AccountSta...1.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AccountStatement_DEC_2021.xlsx

  • Size

    228KB

  • Sample

    211208-l991qshegm

  • MD5

    efdd1d237fd3872bb7579b3baa5f52d3

  • SHA1

    75ebd64ef3ee49cb5fca134c7c2b19b5ea9af4fc

  • SHA256

    60805ace9aa3457ba8fa8c0f815d470a30939370f8fd6d48a2013a49c1727d17

  • SHA512

    0f5d0d0ca52b9753bb18858cd32dfe83804796630d51052985249d8105e9fe1bb3ded3fb44d17686b82ff3a62a61fae6697bccd0c9ba195c694287ed4f217e54

Score
10/10
formbookog2wratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

og2w

C2

http://www.celikkaya.xyz/og2w/

Decoy

drivenexpress.info

pdfproxy.com

zyz999.top

oceanserver1.com

948289.com

nubilewoman.com

ibizadiamonds.com

bosniantv-australia.com

juliehutzell.com

poshesocial.events

icsrwk.xyz

nap-con.com

womansslippers.com

invictusfarm.com

search-panel-avg-rock.rest

desencriptar.com

imperialexoticreptiles.com

agastify.com

strinvstr.com

julianapeloi.com

Targets

    • Target

      AccountStatement_DEC_2021.xlsx

    • Size

      228KB

    • MD5

      efdd1d237fd3872bb7579b3baa5f52d3

    • SHA1

      75ebd64ef3ee49cb5fca134c7c2b19b5ea9af4fc

    • SHA256

      60805ace9aa3457ba8fa8c0f815d470a30939370f8fd6d48a2013a49c1727d17

    • SHA512

      0f5d0d0ca52b9753bb18858cd32dfe83804796630d51052985249d8105e9fe1bb3ded3fb44d17686b82ff3a62a61fae6697bccd0c9ba195c694287ed4f217e54

    Score
    10/10
    formbookog2wratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks