Overview

overview

10

Static

static

10

Invoice an...t.docx

windows7-x64

10

Invoice an...t.docx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice and Packing List.docx

  • Size

    10KB

  • Sample

    230404-qzhwqahb8v

  • MD5

    77366ba07edd55058c59d80acc56d2f8

  • SHA1

    d9f2a22cb7e55bcc38967de8f1802934af77209b

  • SHA256

    91e84268a13b1d03dbf602c0ae560f7c883a6aff8ed7cef2f706f2197ab3caec

  • SHA512

    bf0590b2cc1d50866995ed27413c15f71adec7778078ff8037e4eb995038bedc9cbc7b0a4ff3ae3359a2bc74747265d43b448c458a7d9cf4037b94491ab9eccb

  • SSDEEP

    192:ScIMmtPGT7G/bIwXOVOQTi55SEzBC4vNq6sM63j8p:SPXuT+xXOVOQWnhlqHjw

Score
10/10
formbookne28ratspywarestealertrojanwebsettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

http://00000000000OOOOOLLLLLLLL000000000000LLLLLLLOOOOO00000000000LLLLLLLOOOOO0000000000LLLLL00000000000OOOLLLLLLL@3221468051/x....xx.......doc

Extracted

Family

formbook

Version

4.1

Campaign

ne28

Decoy

basic-careitem.net

healstockton.com

groupetalentapro.com

geseconevent.com

adornmentwithadrienne.com

lazylynx.se

forestwerx.com

labishu.com

hilykan.com

beyondyoursenses.co.uk

inno-imc.com

driverrehab.online

mantlepies.co.uk

sicepat.net

kiwitownkids.com

infiniumsource.com

motorsolutionswithmakro.co.uk

6pg.shop

zijlont.xyz

corpusskencar.com

Targets

    • Target

      Invoice and Packing List.docx

    • Size

      10KB

    • MD5

      77366ba07edd55058c59d80acc56d2f8

    • SHA1

      d9f2a22cb7e55bcc38967de8f1802934af77209b

    • SHA256

      91e84268a13b1d03dbf602c0ae560f7c883a6aff8ed7cef2f706f2197ab3caec

    • SHA512

      bf0590b2cc1d50866995ed27413c15f71adec7778078ff8037e4eb995038bedc9cbc7b0a4ff3ae3359a2bc74747265d43b448c458a7d9cf4037b94491ab9eccb

    • SSDEEP

      192:ScIMmtPGT7G/bIwXOVOQTi55SEzBC4vNq6sM63j8p:SPXuT+xXOVOQWnhlqHjw

    Score
    10/10
    formbookne28ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Abuses OpenXML format to download file from external location

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks