Overview

overview

10

Static

static

Doc2410202...65.exe

windows7-x64

10

Doc2410202...65.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Doc24102022.87654567898765.exe
  • Size 824KB
  • Sample221024-thb9dsheg5
  • SHA256 736808fef49ea666d160c9943b624f0ad79c3d10c44b8042a602d8a31d2465a3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooks5zxratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • s5zx

Decoy

  • wMAY83Xf8pYlwmcLm5HvBdaL

  • CEtcpyGISM/CVFQ5zam3

  • jQE/nMmnXlmcTVQ5zam3

  • kUtRVpN/YY33wLfac81TKg==

  • WxtrRs8s52o/GPsPog==

  • w8LUN0UWABcTD1Hv

  • pCU+Wnk+6/E08im2Xo5y7uea

  • 4o2dnKCJNOgbwud9JfMHrMJuAGI+fg==

  • AbPNtFXXpcoeyWB1WGC/AOiS

  • 5Kbo75EKwcLiArHSoc/SIg==

  • IaICXWtqc2xvU++OXEd+tRitdw==

  • x0M6GKkDC8SPQGd/S61UdfgVZLqVDFg=

  • Y6TEJKsC3IxVJN986uJugqNcN7NO5EU=

  • rltiOepgaw3Mk0Lbt1yoxuA=

  • z94mjMxyFcLUu1Q=

  • xH3F3Hz93BCSMuBtI65JGm+VN3xm

  • +GO142npuuptGPsPog==

  • WX/VsE7R0FTm3Ju2ema/AOiS

  • qam0OKkfCyE6ZKxZtQ==

  • 0ojGr0OMV9khz+4GoA==

Targets

    • Target
      Doc24102022.87654567898765.exe
    • Size 824KB
    • SHA256 736808fef49ea666d160c9943b624f0ad79c3d10c44b8042a602d8a31d2465a3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooks5zxratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks