General

  • Target
    10-23.exe
  • Size 462KB
  • Sample201023-rtddcjmlj2
  • SHA256 f24849d70670b5448e96f02fe8bc12328bee2922be60f70ec8121531778f0d05
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.crazyenergyguy.com/dmr/

Decoy
  • sweetjacks.com

  • onecleaningcare.company

  • learninglabels.com

  • onlinedesignstees.com

  • jjoxxdx.icu

  • nice-tights.com

  • golancpa.com

  • caringforeastcounty.com

  • whitesandretreat.com

  • 1823a.com

  • lazurii.com

  • madisons-deli.com

  • universitynude.com

  • michiganthyroid.com

  • hersidelinestyle.com

  • kumppaurics.com

  • sebicoin.net

  • hatmemama.com

  • oliyad.com

  • avoirbon.com

Targets

    • Target
      10-23.exe
    • Size 462KB
    • SHA256 f24849d70670b5448e96f02fe8bc12328bee2922be60f70ec8121531778f0d05
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks