Overview

overview

10

Static

static

RFQ_OFFER_...14.rtf

windows7_x64

10

RFQ_OFFER_...14.rtf

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ_OFFER_3098_5RFQ-5914.doc

  • Size

    2.2MB

  • Sample

    220131-hks45sghf2

  • MD5

    150261328c9acaecc66968ae0efd37ee

  • SHA1

    19eeff6bfc783323a85950682958f5e006c5b0e8

  • SHA256

    c796080f9c704855e94c27f3126628cc1434b252ae6a8168de81865d7e4eb20a

  • SHA512

    c3bb944949065d71fbdeb054c2d6ac59a52a4e023207087a2c2ae5d8b5b6ed292d01d2405120913e683e7a903fc259719d35c33001aa72e30df74b2d6a5197f0

Score
10/10
formbookcc16ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cc16

Decoy

dcownloadaudiobooks.com

agencyfreedom.net

code9help.com

nextstarwkrg.com

ashleyjana.net

livingarrangementmove.com

nuevorenaultaustral.com

cyptosphere.com

thelearningforestacademy.com

frestail.info

veohat.online

infoemailteamitnetalpha.com

rainforestsloth.com

auzunstore.com

comepritty.com

comchain.digital

spacemind.space

riacompliancebox.com

rocketaccoynt.com

feng01.xyz

Targets

    • Target

      RFQ_OFFER_3098_5RFQ-5914.doc

    • Size

      2.2MB

    • MD5

      150261328c9acaecc66968ae0efd37ee

    • SHA1

      19eeff6bfc783323a85950682958f5e006c5b0e8

    • SHA256

      c796080f9c704855e94c27f3126628cc1434b252ae6a8168de81865d7e4eb20a

    • SHA512

      c3bb944949065d71fbdeb054c2d6ac59a52a4e023207087a2c2ae5d8b5b6ed292d01d2405120913e683e7a903fc259719d35c33001aa72e30df74b2d6a5197f0

    Score
    10/10
    formbookcc16ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks