Overview

overview

10

Static

static

10

Sample.docx

windows7-x64

10

Sample.docx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sample.docx.doc

  • Size

    10KB

  • Sample

    230126-jzz2nsda72

  • MD5

    884bf256520434bf9bdbd7a760176961

  • SHA1

    2c79b5ca06f153b41a93d8ace4a7713d59621d9d

  • SHA256

    574fce61f6fcf5e16be3fd8a77a56aeeb4d7a8868e2dccd0225c9c8c426e2913

  • SHA512

    8216274591743f8f995cfa39753fb06f656d04fb676cde84d28f722adf3bcbe55330639344a898e37576dc71397b0743ecf83cbdbbc6d1c0a85596ee68bb92bd

  • SSDEEP

    192:ScIMmtP8ar5G/bfIdTO3e/YnamWBX8ex6y3slZ:SPXt4ATO9nosMsH

Score
10/10
formbookw12eratspywarestealertrojanwebsettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

http://000000001000000000000020000000000001000000000@104.168.46.125/fresh/qwsdffhfhcvxcdgdfhfgjfjfgdfdfgxcvcxv.doc

Extracted

Family

formbook

Version

4.1

Campaign

w12e

Decoy

poshsalon.co.uk

ideeksha.net

eaglebreaks.com

exileine.me.uk

saveittoday.net

ceon.tech

estateagentswebsitedesign.uk

faropublicidade.com

depression-treatment-83678.com

informationdata16376.com

wirecreations.africa

coolsculpting-pros.life

ethoshabitats.com

amtindividual.com

gotoken.online

cherny-100-imec-msu.ru

historicaarcanum.com

gpsarhealthcare.com

kx1257.com

abdullahbinomar.com

Targets

    • Target

      Sample.docx.doc

    • Size

      10KB

    • MD5

      884bf256520434bf9bdbd7a760176961

    • SHA1

      2c79b5ca06f153b41a93d8ace4a7713d59621d9d

    • SHA256

      574fce61f6fcf5e16be3fd8a77a56aeeb4d7a8868e2dccd0225c9c8c426e2913

    • SHA512

      8216274591743f8f995cfa39753fb06f656d04fb676cde84d28f722adf3bcbe55330639344a898e37576dc71397b0743ecf83cbdbbc6d1c0a85596ee68bb92bd

    • SSDEEP

      192:ScIMmtP8ar5G/bfIdTO3e/YnamWBX8ex6y3slZ:SPXt4ATO9nosMsH

    Score
    10/10
    formbookw12eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Abuses OpenXML format to download file from external location

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks