Overview

overview

10

Static

static

OA74612.xls

windows7-x64

10

OA74612.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OA74612.xls

  • Size

    511KB

  • Sample

    221115-njb25adf43

  • MD5

    cc083b13b3459bd2f581f4afcaef5051

  • SHA1

    23abd922b107ac72fbe337afcd85a089eb669c27

  • SHA256

    ee1b53c87bcbf6604980ab928baaf8e8c70cb26fb341d49f05addd70fed92627

  • SHA512

    f85aee0d80ff76f39cba62f47a2e462d4e0256ab983b530c1af22561edb257dbce9fcf3f5f1f74ab1c37be66f3defe215971c032cb976c209ec03b308f1c8460

  • SSDEEP

    12288:fdNqrDx7XXXXXXXXXXXXUXXXXXXXrXXXXXXXXEmY2TmWTmjnK4D+DX/xao7ZmwW0:Cr5XXXXXXXXXXXXUXXXXXXXrXXXXXXXF

Score
10/10
formbookg2dcratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

g2dc

Decoy

OqIwFVmXHnPUgdurr7I=

0YwewYtWNLZdkF7Q

HFT6VwOYdkifOpbT1h9DcYQ=

D+zGTvGlpriTumzBbw==

gMSID89/QqMV8yjH

HN5/g0/3yJBsnZCig9Qf

Hl33xdRU8xaC1rY=

/rhq03DorPAUH2bSp6228fGQ

gBwzCyfHge9SumzBbw==

NuOmK9+fenLQa9urr7I=

cA4+yKM4IQjpFwMt1BQEUJ1q6y0=

gpK3pqdoVNu93yS0uhocUtQmtQ==

3i3tx82Rf7yQdIyeprA=

FTo+4qVlVK7gIgxi0g3bUA==

7kDtq4wo6+cV8yjH

Dc123pIo9vcNuR9pwkQ0pPpHvQ==

KYREtH0zKNiI374=

Tok2qF4n2XOiRw==

DYFtA6ZXUJfA3MLhRtTVTQ==

C8poIeeskBCxEYHIbQ==

Targets

    • Target

      OA74612.xls

    • Size

      511KB

    • MD5

      cc083b13b3459bd2f581f4afcaef5051

    • SHA1

      23abd922b107ac72fbe337afcd85a089eb669c27

    • SHA256

      ee1b53c87bcbf6604980ab928baaf8e8c70cb26fb341d49f05addd70fed92627

    • SHA512

      f85aee0d80ff76f39cba62f47a2e462d4e0256ab983b530c1af22561edb257dbce9fcf3f5f1f74ab1c37be66f3defe215971c032cb976c209ec03b308f1c8460

    • SSDEEP

      12288:fdNqrDx7XXXXXXXXXXXXUXXXXXXXrXXXXXXXXEmY2TmWTmjnK4D+DX/xao7ZmwW0:Cr5XXXXXXXXXXXXUXXXXXXXrXXXXXXXF

    Score
    10/10
    formbookg2dcratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks