Overview

overview

10

Static

static

Alligator ...te.rtf

windows7_x64

10

Alligator ...te.rtf

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Alligator Pty Ltd Quote.doc

  • Size

    11KB

  • Sample

    220127-qaz4psdagn

  • MD5

    5ca2cd21f345b9af1dcb83321284c60f

  • SHA1

    858e1756867ad4c771ea5065fc5b42de2e1f0a7c

  • SHA256

    d76844ff49e147c7c93bafadbafe15eced2ab1ab22ffe4a0fd93434bba4351f8

  • SHA512

    6be94ca0705eaa78c437819b0a66d2f87c34ceab51ab4b73e632b5c5961eb54157bd746b3012e640a3880346a539a71f7f3bf0b022c612486ee1f18768780634

Score
10/10
formbookcw22ratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cw22

Decoy

betvoy206.com

nftstoners.com

tirupatibuilder.com

gulldesigns.com

shemhq.com

boricosmetic.com

bitcoinbillionaireboy.com

theflypaperplanes.com

retrocartours.com

yangzhie326.com

cheepchain.com

sentryr.com

luckirentalhomes.com

pointssquashers.com

dianasarabiantreasures.com

calendarsilo.com

sublike21.xyz

gajubg0up.xyz

lousfoodreviews.com

fades.site

Targets

    • Target

      Alligator Pty Ltd Quote.doc

    • Size

      11KB

    • MD5

      5ca2cd21f345b9af1dcb83321284c60f

    • SHA1

      858e1756867ad4c771ea5065fc5b42de2e1f0a7c

    • SHA256

      d76844ff49e147c7c93bafadbafe15eced2ab1ab22ffe4a0fd93434bba4351f8

    • SHA512

      6be94ca0705eaa78c437819b0a66d2f87c34ceab51ab4b73e632b5c5961eb54157bd746b3012e640a3880346a539a71f7f3bf0b022c612486ee1f18768780634

    Score
    10/10
    formbookcw22ratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks