Overview

overview

10

Static

static

1

SecuriteIn...93.rtf

windows7-x64

10

SecuriteIn...93.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Exploit.CVE-2018-0798.4.23906.18593.rtf

  • Size

    442KB

  • Sample

    240620-dxf8wszhll

  • MD5

    5b235feb1c1b78d5277c93bd7b0c2e6e

  • SHA1

    5e9bebe9b3c3b44f03eb12c9484f7e3f5749c687

  • SHA256

    ed8e464b52a9d62400ba9b9e39fa37555e4b0db548487f56a5ea89b7bdcf9648

  • SHA512

    a8e9333c705a1d20b47487455583ce211ba0b497a2a4d120671351a3b4f19eb3346b719b5f5e0ab367fb4ab30b233a73910c5392e26acc014e2ff85509f37b75

  • SSDEEP

    6144:1wAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAlnp/bVl7GR:xpy

Score
10/10
formbookbi09executionratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bi09

Decoy

fayenterprises.online

anekagaminghk.rest

mina-chan.site

theselfcarefaire.com

progym.app

cherishedtimes.space

gkrp9s016x.icu

api288-s-rtp.online

chikankari.shop

annarosellc.com

lcloud.services

aisuitability.com

sks41.com

7779c1.vip

tunasolution.click

nexbetwin.com

huatless.quest

junroptskdyued.shop

yourwellnesseq.com

zcymc.top

Targets

    • Target

      SecuriteInfo.com.Exploit.CVE-2018-0798.4.23906.18593.rtf

    • Size

      442KB

    • MD5

      5b235feb1c1b78d5277c93bd7b0c2e6e

    • SHA1

      5e9bebe9b3c3b44f03eb12c9484f7e3f5749c687

    • SHA256

      ed8e464b52a9d62400ba9b9e39fa37555e4b0db548487f56a5ea89b7bdcf9648

    • SHA512

      a8e9333c705a1d20b47487455583ce211ba0b497a2a4d120671351a3b4f19eb3346b719b5f5e0ab367fb4ab30b233a73910c5392e26acc014e2ff85509f37b75

    • SSDEEP

      6144:1wAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAlnp/bVl7GR:xpy

    Score
    10/10
    formbookbi09executionratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks