Overview

overview

10

Static

static

1

30% Paymen...pt.rtf

windows7-x64

10

30% Paymen...pt.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30% Payment Receipt.doc

  • Size

    42KB

  • Sample

    230626-kf6wjsaa2y

  • MD5

    d4bc695be1f64cb89c061b21b06815a2

  • SHA1

    4056cdfa99fe137e1324be62763aee23d1990eb7

  • SHA256

    ad167c04c640a9777e7b6bb420e64b5cc46a0fd588820f6895420991465944a0

  • SHA512

    1ddb705be7d901acd7f9889bdfb4491ce4c5a9619884f083c79ac4046285d786e54ce6aabcf4eacbf6fc522804c27b8cc88f20b5077ef249d0f9c93390806221

  • SSDEEP

    768:rFx0XaIsnPRIa4fwJMo30VYWEfOH/cNUWTL4QUATxZA9fSP3/Uz+o4KSAIR:rf0Xvx3EMo32YWEfrkVAV//Uz+o46IR

Score
10/10
formbookxchuratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Targets

    • Target

      30% Payment Receipt.doc

    • Size

      42KB

    • MD5

      d4bc695be1f64cb89c061b21b06815a2

    • SHA1

      4056cdfa99fe137e1324be62763aee23d1990eb7

    • SHA256

      ad167c04c640a9777e7b6bb420e64b5cc46a0fd588820f6895420991465944a0

    • SHA512

      1ddb705be7d901acd7f9889bdfb4491ce4c5a9619884f083c79ac4046285d786e54ce6aabcf4eacbf6fc522804c27b8cc88f20b5077ef249d0f9c93390806221

    • SSDEEP

      768:rFx0XaIsnPRIa4fwJMo30VYWEfOH/cNUWTL4QUATxZA9fSP3/Uz+o4KSAIR:rf0Xvx3EMo32YWEfrkVAV//Uz+o46IR

    Score
    10/10
    formbookxchuratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks