formbook

General

Target

BOL_Shipping Docs.xlsx.exe
Size

673KB
Sample

221117-pgldfsec95
MD5

d4a1e9a56c52defb53402c08964d4569
SHA1

c907fd3db66a9ea9dfe45dc9fe3c706a18b4b3d9
SHA256

786aeabdb7664ab3c99105d7705946a0d3259b9096e5464db67eab31a2637194
SHA512

efda4d59c8020a1237206c60ff97ec625ce3f27bdf9634c6afb6eac88346c40804521b1d23d92ab8bfede6ffb5bc39ae3acaeeaf594b6dcd66bb34dc18b01907
SSDEEP

12288:ijcWU4GBbGgm0Gz6khFH79hz4b+Ku5L5daXcCAVN+/9/Guz:XfBKgNGz64Xg6L5dQMVNy

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

n2hm

Decoy

XCeG4IxNKbAl

YzJWbnC+El84nA==

KAJcdmP8yEcO5LXPCFF42Wfb

I+J+xYO95GJQWVU=

GtgxPPv3FmQmhw==

Og9NYF4xEl+j7vGTR93xvg==

506Cg07bsT0G6yK+A96H0h35V+JLkwI=

wAYXFN+pSFIXgQ==

ijzLI/f+FmQmhw==

UfT2PweNm+w8

GQWVw5aZnfF/kS5e

30BKYjua9zcA7gAwsPUngLnjyrBNEgo=

AM65OrmyFmQmhw==

VSlTVxISZ4J/kS5e

GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==

B9H98cUUfX+AWOqiTA==

MxVffWOIoVnM37zrd2sTaOY=

z6bxCgG/mGhR7oDzQA==

pQgSLSRi6AK3M/PdArpX

6rRRsYuSnXx/kS5e

Targets

- Target
  
  BOL_Shipping Docs.xlsx.exe
- Size
  
  673KB
- MD5
  
  d4a1e9a56c52defb53402c08964d4569
- SHA1
  
  c907fd3db66a9ea9dfe45dc9fe3c706a18b4b3d9
- SHA256
  
  786aeabdb7664ab3c99105d7705946a0d3259b9096e5464db67eab31a2637194
- SHA512
  
  efda4d59c8020a1237206c60ff97ec625ce3f27bdf9634c6afb6eac88346c40804521b1d23d92ab8bfede6ffb5bc39ae3acaeeaf594b6dcd66bb34dc18b01907
- SSDEEP
  
  12288:ijcWU4GBbGgm0Gz6khFH79hz4b+Ku5L5daXcCAVN+/9/Guz:XfBKgNGz64Xg6L5dQMVNy
Score

10^/10

formbook n2hm rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2