Overview

overview

10

Static

static

1

OpTransact...23.rtf

windows7-x64

10

OpTransact...23.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OpTransactionHistory 20-06-2023.doc

  • Size

    49KB

  • Sample

    230620-lnmy3scd41

  • MD5

    2e888f471d5be28c1f4e6e2d93b8d392

  • SHA1

    6faea96df6e11baebdeecbd06868b4770e615c86

  • SHA256

    f0cd9d141194b4081974323fdfc622ba83bfa9552585867681386bd462b94023

  • SHA512

    1314cfcb0a7899e88dfd691e74aca84d7d67f42fec6020abd82258c0e593fe6dff5a9d2e48aef54b3ea63e9f551d150894d433be99bbc542f5a2af431aab8b27

  • SSDEEP

    768:LFx0XaIsnPRIa4fwJMhNpUFasNAv7MgYVMc0D+F+lDH5C:Lf0Xvx3EMhNH7Mp/F+lVC

Score
10/10
formbookxchuratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Targets

    • Target

      OpTransactionHistory 20-06-2023.doc

    • Size

      49KB

    • MD5

      2e888f471d5be28c1f4e6e2d93b8d392

    • SHA1

      6faea96df6e11baebdeecbd06868b4770e615c86

    • SHA256

      f0cd9d141194b4081974323fdfc622ba83bfa9552585867681386bd462b94023

    • SHA512

      1314cfcb0a7899e88dfd691e74aca84d7d67f42fec6020abd82258c0e593fe6dff5a9d2e48aef54b3ea63e9f551d150894d433be99bbc542f5a2af431aab8b27

    • SSDEEP

      768:LFx0XaIsnPRIa4fwJMhNpUFasNAv7MgYVMc0D+F+lDH5C:Lf0Xvx3EMhNH7Mp/F+lVC

    Score
    10/10
    formbookxchuratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks