General

  • Target

    QUO684506.xls

  • Size

    420KB

  • Sample

    240514-h5htxaeh4y

  • MD5

    65ae45789b58f1e03a4f8c3f178e6b30

  • SHA1

    4eb87b3825da0d23d7f7091c2976e1e95cc40907

  • SHA256

    1ccd3e2580b4e0de27bfeae3a92d638230c573704c66a06a0e11018224d176a0

  • SHA512

    6d7da073e7280bf84612920a6371b19a1226fa50747587dbfe9fe10ed6bdf514ab8b171605d34a0a090d5f9ee3dbe4ec5e6fa379a73dc4675c8f4e46e359e864

  • SSDEEP

    6144:NZ+RwPONXoRjDhIcp0fDlavx+W26nAHu8uniSHBMixiMK6G+ZFrTUvCp4sJgpQMD:31iQpozwjTqCfgdhd/+Z4uCz2BFmDiP

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ht3d

Decoy

derlon.net

46gem.vip

bridal-heart-boutique.com

porarquitectura.com

durkal.online

9916k.vip

nativegarden.net

hoodjac.com

coachwunder.com

jutuowangluo.com

frankmontagna.com

jalenx.com

yhxg.net

brasserie-bro.com

whitecoatprivilege.com

sigmadriving.com

inhkipcmacau.com

freediveexperience.com

52iwin.com

aaditt.com

Targets

    • Target

      QUO684506.xls

    • Size

      420KB

    • MD5

      65ae45789b58f1e03a4f8c3f178e6b30

    • SHA1

      4eb87b3825da0d23d7f7091c2976e1e95cc40907

    • SHA256

      1ccd3e2580b4e0de27bfeae3a92d638230c573704c66a06a0e11018224d176a0

    • SHA512

      6d7da073e7280bf84612920a6371b19a1226fa50747587dbfe9fe10ed6bdf514ab8b171605d34a0a090d5f9ee3dbe4ec5e6fa379a73dc4675c8f4e46e359e864

    • SSDEEP

      6144:NZ+RwPONXoRjDhIcp0fDlavx+W26nAHu8uniSHBMixiMK6G+ZFrTUvCp4sJgpQMD:31iQpozwjTqCfgdhd/+Z4uCz2BFmDiP

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Abuses OpenXML format to download file from external location

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks