Overview

overview

10

Static

static

Acnova Ltd Order.rtf

windows7_x64

10

Acnova Ltd Order.rtf

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Acnova Ltd Order.doc

  • Size

    8KB

  • Sample

    220209-l44a1aaahp

  • MD5

    0cc2a75f1bc1ba4ae96308ab60fd927a

  • SHA1

    6928b886c9f05f806aa1e4fe94d81faed9d457e5

  • SHA256

    2b2373f89840655743001d31c00783626526f327e88ffc3a9344d8810499693f

  • SHA512

    d50e6ca503e5e94c1fc15857c3abd842daa0c9315c9e7c3d206e0958853654516cb31e582c48397f120e87fcd4d1ae5b056668150148b96d08498a5500699d36

Score
10/10
formbookcw22ratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cw22

Decoy

betvoy206.com

nftstoners.com

tirupatibuilder.com

gulldesigns.com

shemhq.com

boricosmetic.com

bitcoinbillionaireboy.com

theflypaperplanes.com

retrocartours.com

yangzhie326.com

cheepchain.com

sentryr.com

luckirentalhomes.com

pointssquashers.com

dianasarabiantreasures.com

calendarsilo.com

sublike21.xyz

gajubg0up.xyz

lousfoodreviews.com

fades.site

Targets

    • Target

      Acnova Ltd Order.doc

    • Size

      8KB

    • MD5

      0cc2a75f1bc1ba4ae96308ab60fd927a

    • SHA1

      6928b886c9f05f806aa1e4fe94d81faed9d457e5

    • SHA256

      2b2373f89840655743001d31c00783626526f327e88ffc3a9344d8810499693f

    • SHA512

      d50e6ca503e5e94c1fc15857c3abd842daa0c9315c9e7c3d206e0958853654516cb31e582c48397f120e87fcd4d1ae5b056668150148b96d08498a5500699d36

    Score
    10/10
    formbookcw22ratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks