Overview

overview

10

Static

static

1

Order Prof...ce.xls

windows7-x64

10

Order Prof...ce.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order Proforma Invoice.xls

  • Size

    317KB

  • Sample

    240321-vsl21sch76

  • MD5

    3347a85bc38cd1bfe81a8078aa998ec2

  • SHA1

    abe49d8527c397a63172f35612296f1056027c5d

  • SHA256

    8373f60ec68dc7de83b3e7c6bf8af263d7f3e24abb720774876755c3e2787186

  • SHA512

    6aa8e56e0261e017ad6df92aec3d05b5a64a216294cef00e86332f628d13ea0d27ed225f6306a441c47705016ea79523c4073f6dc32f061c047180c313ceb3a0

  • SSDEEP

    6144:oAunhXMYY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVToMIn7oExdNoJUk9wD+:oZhXM13bVToMInE0dOUkMw

Score
10/10
formbookrc2iratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rc2i

Decoy

alphatierofficial.online

nrk888.com

jolosobgoh.com

xn--fiq07xcnfrep5pz43a.com

bankingvt.com

bhadgaonwitc.best

providenceweightloss.com

thehouseofroyals.llc

ndxick.cfd

80x2.net

southpole.blue

buisnesswithjos.com

8thbit.net

jointanglediagnostics.com

poppyandpetunia.shop

iamtaylordarling.com

liftdetoxblack.pro

suntohomestore.com

simsonic.net

eliteinfinitygroupoficial.com

Targets

    • Target

      Order Proforma Invoice.xls

    • Size

      317KB

    • MD5

      3347a85bc38cd1bfe81a8078aa998ec2

    • SHA1

      abe49d8527c397a63172f35612296f1056027c5d

    • SHA256

      8373f60ec68dc7de83b3e7c6bf8af263d7f3e24abb720774876755c3e2787186

    • SHA512

      6aa8e56e0261e017ad6df92aec3d05b5a64a216294cef00e86332f628d13ea0d27ed225f6306a441c47705016ea79523c4073f6dc32f061c047180c313ceb3a0

    • SSDEEP

      6144:oAunhXMYY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVToMIn7oExdNoJUk9wD+:oZhXM13bVToMInE0dOUkMw

    Score
    10/10
    formbookrc2iratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Abuses OpenXML format to download file from external location

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks