Overview

overview

10

Static

static

1

Quo2024.docx

windows7-x64

10

Quo2024.docx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Quo2024.docx

  • Size

    16KB

  • Sample

    240705-qw645s1hpb

  • MD5

    3fbe5c0fdd008937310bc6c9dba29c2d

  • SHA1

    c4fbc0de50070bae54fdabb458260f8d2878a117

  • SHA256

    4b8f8f705246d7d980911042c089e9a9fb450031d5dde069add5f4a207c32dc4

  • SHA512

    427800453db7bc6203a6b9166aa73c5a4a15af2b634eb41bcee65d85cbee212c517df431517f929684ef369a818ef170414455b56a2dbbc4cd656ac2f338b333

  • SSDEEP

    384:gyXhR4pW0s8PL8wi4OEwH8TIbE91r2fRAJYjviedmPkGf:gch8L5P3DOqnYJOqvzdmPka

Score
10/10
formbookguloaderdd01downloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dd01

Decoy

1prostitutki-chelyabinska.com

o2v7c.rest

something-organized.com

etc99.store

perksaccess.contact

consuyt.xyz

dscmodelpapers.com

dana88.lat

dumange.com

pointlomabarreboutique.com

djtmaga.net

dentisttanger.com

17251604.com

dogcatshoponline.com

eppgrandeur.com

jyty3500.com

felixkang.asia

xn--22ck2ci1dl0f7b7h.com

milliesrecruitment.com

www333804000.com

Targets

    • Target

      Quo2024.docx

    • Size

      16KB

    • MD5

      3fbe5c0fdd008937310bc6c9dba29c2d

    • SHA1

      c4fbc0de50070bae54fdabb458260f8d2878a117

    • SHA256

      4b8f8f705246d7d980911042c089e9a9fb450031d5dde069add5f4a207c32dc4

    • SHA512

      427800453db7bc6203a6b9166aa73c5a4a15af2b634eb41bcee65d85cbee212c517df431517f929684ef369a818ef170414455b56a2dbbc4cd656ac2f338b333

    • SSDEEP

      384:gyXhR4pW0s8PL8wi4OEwH8TIbE91r2fRAJYjviedmPkGf:gch8L5P3DOqnYJOqvzdmPka

    Score
    10/10
    formbookguloaderdd01downloaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Formbook payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Abuses OpenXML format to download file from external location

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

3
T1082

Query Registry

3
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks