General

  • Target

    Order(P.O_R477304).xls

  • Size

    1.5MB

  • Sample

    221209-m2zqgada44

  • MD5

    8fad80b104bd3234323be9171aed903f

  • SHA1

    e1190346d14c15788685e77347a827f7086adb2c

  • SHA256

    b66c265b35372a58775ab68db5392014be36b745f4647df6c3da1c0a7aab82fc

  • SHA512

    a1fce52b3e0958a8297b3adb0b0fdce46952ad5b96ac3ab6ce180f4d7e96dd39f5ce7015d0a168299c999776420b3d87d003bcac91eff6b56db359c1de53277d

  • SSDEEP

    24576:1zxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDgm/qr5XXXXXXXXXXXXUXXXXXXXrXXX9:mP7f4Qkle

Malware Config

Extracted

Family

formbook

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb

jcfGYzPgZTqFZVO9FV2yIw==

laIfrdSC8/4CNg==

Q73ilev5GIWuOrAAFV2yIw==

Q2u/pMw7pv4sPA==

TbqvIUHwlQscPo0HFV2yIw==

8PNWfGPyE8n0IQ==

WtgROxXzvY2L

PryaRBNjm4eP

Y9Hdi06Cry1um9Sj68YAu1o=

3Gulyp7CMQtR78jvLkk=

JJ3GasTVTCRQT6Tfz6S6GlI=

RnS42bhb9tI0R6UpD6wOxriNxw==

he1mi2sOGfzTRGHnuA==

eaYjCtjxVjdU5XLRtBMBLKk9quA=

k9rTeEqYzzw8WaTfz6S6GlI=

5luVQwe2vJWKEAiMdF4=

MGW14L9OVk5Y5TaR6w/DqdhYxXVY

mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

y5klhuMbE8n0IQ==

Targets

    • Target

      Order(P.O_R477304).xls

    • Size

      1.5MB

    • MD5

      8fad80b104bd3234323be9171aed903f

    • SHA1

      e1190346d14c15788685e77347a827f7086adb2c

    • SHA256

      b66c265b35372a58775ab68db5392014be36b745f4647df6c3da1c0a7aab82fc

    • SHA512

      a1fce52b3e0958a8297b3adb0b0fdce46952ad5b96ac3ab6ce180f4d7e96dd39f5ce7015d0a168299c999776420b3d87d003bcac91eff6b56db359c1de53277d

    • SSDEEP

      24576:1zxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDgm/qr5XXXXXXXXXXXXUXXXXXXXrXXX9:mP7f4Qkle

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks