formbook

General

Target

MV. WBC TBN 1._PARTICULARS.exe
Size

429KB
Sample

221003-hsnjmadhbq
MD5

f9ab0dee05ae6ec17cc0d971213ff477
SHA1

11b0ca2284db669e655624bbdf06c96bbc21e989
SHA256

362bf939fb73269fe4298d695eceb9dd95161f6346b75fcf1b756010903d05d3
SHA512

13b37c3c6f765ab4c6d974a33d471aa2274d73fc9f07c0055dc5fa7bda502f8a9d9568f8ec95043b9578e7c2abfab9dcfed6d32ccd842183ce9be2ee3a2fd7f1
SSDEEP

6144:ooqVyigXq1rRPYU4VSyv4IAXp9il7kDnobvh6JvH9ASHjOXUBMFsR:6Vy2fPOOpANGUh2vH9AfEBMY

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

ermr

Decoy

ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=

qNSdDhu/PT/1fgafDagiCSZH1SY=

wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=

jSxRvptHkeTGl7PT0SEmaZmjqzanuA==

b91oL+2wCcpyhnd6yvF6Pg==

mr81yp1/qqZX

hy7Xsz/PU/LWHMcGL4UYJx9n3A==

KlwrHt1gouPaXaWhoQ==

ng8M320IRJL9Ptw=

8GQbOXuaWxvKnNM=

XndOL7E5sNpVUNty4d/a

rryPBBC8PybYb+2h2MF3FHGL

kEoeyERSVCYO0g==

5/P+SBDby5hO

1fYXc30/h9W7iO17

34X+YKR+wRFE

8ir/X2MlVByh5lQ1ow8=

u9ikm2UMZ7J7hpCYow==

FLI+c3clp1BNDjVAfvC2Dnw=

t21Erq8/r09wAzAJTAH3Ng==

Targets

- Target
  
  MV. WBC TBN 1._PARTICULARS.exe
- Size
  
  429KB
- MD5
  
  f9ab0dee05ae6ec17cc0d971213ff477
- SHA1
  
  11b0ca2284db669e655624bbdf06c96bbc21e989
- SHA256
  
  362bf939fb73269fe4298d695eceb9dd95161f6346b75fcf1b756010903d05d3
- SHA512
  
  13b37c3c6f765ab4c6d974a33d471aa2274d73fc9f07c0055dc5fa7bda502f8a9d9568f8ec95043b9578e7c2abfab9dcfed6d32ccd842183ce9be2ee3a2fd7f1
- SSDEEP
  
  6144:ooqVyigXq1rRPYU4VSyv4IAXp9il7kDnobvh6JvH9ASHjOXUBMFsR:6Vy2fPOOpANGUh2vH9AfEBMY
Score

10^/10

formbook ermr persistence rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Adds policy Run key to start application

Blocklisted process makes network request

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2