Overview

overview

10

Static

static

KOC BQ-202...8.xlsx

windows7-x64

10

KOC BQ-202...8.xlsx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KOC BQ-2022-PROC-SI-68.xlsx

  • Size

    110KB

  • Sample

    220725-k45ndsbgej

  • MD5

    21889c7c54d86bd8b3e376a8f23e068c

  • SHA1

    433870de72541bf95aa33bdd8d03f7039a30e853

  • SHA256

    cc5b8184b5f785130a42a53b8600a5d12721f49ee6949d93e3a3722f98604135

  • SHA512

    9fc8f6f489a9b13e2fef8a52927d582e5088313a2d1ea35097ab40fea68b949c337bb26f08fac97b981896e7e45c72dc4fbf06d9d9b046c754a5c9a5d2551df9

Score
10/10
formbooks4s9ratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s4s9

Decoy

qianyuandianshang.com

bernardklein.com

slhomeservices.com

findasaas.com

janellelancaster.xyz

umkpro.site

nr6949.online

mersquare.club

lanariproperties.com

3rdeyefocused.com

giftexpress8260.xyz

hilleleven.xyz

beajod.com

kosazs.online

ishare.team

mb314.com

xjjinxingda.com

ayekooprojectamazing.com

ballsybanter.com

todayshoppingbd.com

Targets

    • Target

      KOC BQ-2022-PROC-SI-68.xlsx

    • Size

      110KB

    • MD5

      21889c7c54d86bd8b3e376a8f23e068c

    • SHA1

      433870de72541bf95aa33bdd8d03f7039a30e853

    • SHA256

      cc5b8184b5f785130a42a53b8600a5d12721f49ee6949d93e3a3722f98604135

    • SHA512

      9fc8f6f489a9b13e2fef8a52927d582e5088313a2d1ea35097ab40fea68b949c337bb26f08fac97b981896e7e45c72dc4fbf06d9d9b046c754a5c9a5d2551df9

    Score
    10/10
    formbooks4s9ratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks