Overview

overview

10

Static

static

DHL Consig...df.exe

windows7-x64

10

DHL Consig...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DHL Consignment_pdf.exe
  • Size 1.2MB
  • Sample221108-s2ggsaebd3
  • SHA256 d638e7ea6048de830f145ff0e37950b009c10da0b49be87a145a9418541a0cdd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookfigcpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • figc

Decoy

  • 47NW9KXrL+jgHgkaH/SBm7e9+eE=

  • ZiDP2+PQatbRpw==

  • McLVGasjijBUTSo=

  • 7pCDHTcZBQCyFKFSb/4E

  • YwIKwvCFzlnbzcNqDNZ3WH77

  • yFJV/xjTQINSFzg=

  • HJb3EiH2afruNRSvM8UmOTJszaNv

  • vpTsJ8xRpExCgnlkzaoM

  • hUfQlYHe4Qb+DVchQM/mlOM2kjVisoJUMQ==

  • 0URByQED2NCVrO2x5w==

  • 0rjp8oD4ZRKfuI9GPlhwJA==

  • dxYJqqoonh7bHhMqMNIxXJnL5biDg2uv

  • N8ICb2IiuRdOx0dgucigiZ0DBA==

  • xmZ3s1jrZPStPdn5PlhwJA==

  • UxQyYwqi37V3q59to3PU5ZOZtoEGTcin

  • SpBGRe06ITs14S8=

  • spVKc4gldemrMNzf

  • 6IBwrjx2XTs14S8=

  • FOp6CqjQtLdXT25kzaoM

  • P/O46RkpqQ8Uvw==

Targets

    • Target
      DHL Consignment_pdf.exe
    • Size 1.2MB
    • SHA256 d638e7ea6048de830f145ff0e37950b009c10da0b49be87a145a9418541a0cdd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookfigcpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks