Overview

overview

10

Static

static

Order details.xlsx

windows7_x64

10

Order details.xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order details.xlsx

  • Size

    176KB

  • Sample

    220706-qhxcsadbcj

  • MD5

    36e3875fa058105bc9eedb62543d3816

  • SHA1

    ee1efdb171829d12f3f2eb43a4e3321121b58397

  • SHA256

    54addec2aa97b3938c4ff81ee36cb37d4d3597b3c7b81f3e8106ba35e1bcbd0b

  • SHA512

    18678a33e3b3320f2e0b57484871a06cfc3a2ce2e6e4a9ab6c01c1c57664eb2e42c224cfc1f7ad78fde503699edf879156fecc1fdf63895e61e4387706ac0d53

Score
10/10
formbooks3s3ratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s3s3

Decoy

tvielotus.com

teesta.xyz

talentrecruitor.com

pamaungipb.com

xn--90ahkh6a6b8b.site

910carolina.com

toyotaecoyouth-dev.com

invetnables.com

gdexc.com

ssw168.com

householdmould.com

mqttradar.xyz

t333c.com

thepausestudio.com

evershedsutherlands.com

asbdataplus.com

preddylilthingz.com

jepwu.com

tvlido.com

artovus.com

Targets

    • Target

      Order details.xlsx

    • Size

      176KB

    • MD5

      36e3875fa058105bc9eedb62543d3816

    • SHA1

      ee1efdb171829d12f3f2eb43a4e3321121b58397

    • SHA256

      54addec2aa97b3938c4ff81ee36cb37d4d3597b3c7b81f3e8106ba35e1bcbd0b

    • SHA512

      18678a33e3b3320f2e0b57484871a06cfc3a2ce2e6e4a9ab6c01c1c57664eb2e42c224cfc1f7ad78fde503699edf879156fecc1fdf63895e61e4387706ac0d53

    Score
    10/10
    formbooks3s3ratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks