General

  • Target

    PO.doc

  • Size

    11KB

  • Sample

    220131-n3fjnahfe5

  • MD5

    e57459af29551726024c5248739a1971

  • SHA1

    89494d2a840d5681b84a01767d42980eb3530003

  • SHA256

    0da037449078eb28dffcd95733769019ee21831ac82b12d845fb051be22b33ec

  • SHA512

    96712d136260118c87a906dc2066db875f18a5448f4fb0b9098ba5d46243410b41f041c745fbb1f086abb2ec38ec247ea63e8e466335d202237eeb5530f55854

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy93

Decoy

alexito.space

shitsthebalm.com

margaritavillemelbourne.com

vonahk.xyz

1960lawn.com

augustacrim.com

bancopec.com

batrainingstudio.com

kokofleks.store

w4-form-irs.com

putnamob.com

mickeysmotors.com

8181yd.com

wedmecreation.com

mischianti.com

gskpop.com

douvip303.com

unlimitedlyfestylez.com

originophthalmics.com

oandazx86.xyz

Targets

    • Target

      PO.doc

    • Size

      11KB

    • MD5

      e57459af29551726024c5248739a1971

    • SHA1

      89494d2a840d5681b84a01767d42980eb3530003

    • SHA256

      0da037449078eb28dffcd95733769019ee21831ac82b12d845fb051be22b33ec

    • SHA512

      96712d136260118c87a906dc2066db875f18a5448f4fb0b9098ba5d46243410b41f041c745fbb1f086abb2ec38ec247ea63e8e466335d202237eeb5530f55854

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets service image path in registry

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks