General

  • Target

    5876985.doc

  • Size

    10KB

  • Sample

    220131-r1eq5aaaa9

  • MD5

    b69f10b44dfc89ed9f3c4cce4329e470

  • SHA1

    0ddf069cd3b18aeb88cf246d4bd18be2af6e68f4

  • SHA256

    22c6cb28e8da3b71d9c3d14f2c1fb8f2b5905fd83a2b8b0b5e5089d336e93ba2

  • SHA512

    2601913dd64bb194334aabe4286029b2db588b45732c206cadbf5933e9a04be58db89f863167a46abaee59639ff720b35803b1b01a64e78b266bc9f0755eb719

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bt33

Decoy

mbaonlinefreedegress.info

myforevermaid.com

daoyi365.com

weientm.com

legal-mx.com

formationrigging.com

heidiet.xyz

school-prosto.store

healthvitaminnutrition.com

digitalsolutionusa.com

little-bazar.com

jnbeautycanada.com

optoelek.com

learntoairmail.com

hawkminer.com

kingofearth.love

ktnstay.xyz

zouxin.love

mainlandpr.com

mamm-hummel.com

Targets

    • Target

      5876985.doc

    • Size

      10KB

    • MD5

      b69f10b44dfc89ed9f3c4cce4329e470

    • SHA1

      0ddf069cd3b18aeb88cf246d4bd18be2af6e68f4

    • SHA256

      22c6cb28e8da3b71d9c3d14f2c1fb8f2b5905fd83a2b8b0b5e5089d336e93ba2

    • SHA512

      2601913dd64bb194334aabe4286029b2db588b45732c206cadbf5933e9a04be58db89f863167a46abaee59639ff720b35803b1b01a64e78b266bc9f0755eb719

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets service image path in registry

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks