General

  • Target

    eecb5ed628aa49f55850fce6c0d54f02.bin.bin

  • Size

    13KB

  • Sample

    230507-j7mrbabf2w

  • MD5

    64374845b5a41ef64504f5896459948e

  • SHA1

    c9736c17cf753ff170715518383f4324ddab5401

  • SHA256

    b240d9fe3e58bcbebc9f3a2b58697df0f22c4982579483be43444012e18cfa15

  • SHA512

    ee5d549a5c951357be6ecd7c88aaf8a612469babca1e2d234aa3bbaea40022c0f225155bd9579445aa088c36a38402142d80b0807c714c1d017263120a188c91

  • SSDEEP

    384:6r02PSNIhkmYVtsDQcGh0aFkoZJgs7iVHLr2:6r0gOIPYsE3h0aFkokOiVrr2

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      300500a190d25155cc8c4d880b4017c2ad4d339944091b5eee37be754a3e9251.doc

    • Size

      31KB

    • MD5

      eecb5ed628aa49f55850fce6c0d54f02

    • SHA1

      a855c7bab5a62c5f0b7618ce95e2044c00bde39e

    • SHA256

      300500a190d25155cc8c4d880b4017c2ad4d339944091b5eee37be754a3e9251

    • SHA512

      53cf9f1abc9f01fbed5440c0c3d9bca2878bc0ac71f487ec43414471cd49b20d2ce1292dc54d7f690bc25ad5fe42716e817508de3c45f40b3b5057f32d74b2bd

    • SSDEEP

      384:cL0AbZS/DVsA5p08oGfMuWKZB9FkDoMDcUXjG1yiZyjJNPcSdwzuIzMo99zE:cwAbZS/D55pToHuWKfoDoMBiIdiNE

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks