Overview

overview

10

Static

static

hbpuIkG2187U2uC.exe

windows7-x64

10

hbpuIkG2187U2uC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    hbpuIkG2187U2uC.exe
  • Size 660KB
  • Sample221117-vf983sba2w
  • SHA256 849c96dad8e472bb60d06687e6da765c687355295f98348286c25d8d2a9ae613
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbmr1ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • bmr1

Decoy

  • q05YNsJC4MpYLGAf4A==

  • 6KUzKCvwX0fwzrFQXvlucw==

  • KA4ZibW1w+hWN5Q=

  • TfgNq18tIWtsM7h+DexncQ==

  • zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==

  • hopQr+b8KzPIbMWvw0Yxir6cyw==

  • 2thmt+17FR/MVsakbM/+w3xGOhopJw==

  • 5gO5gfA6jwna/4FNSPqrvvHyr2A=

  • kqtr0wr9KaOXVMyDDexncQ==

  • PNldyz0Boa5cLGAf4A==

  • Gysor7fqabd0UzTwWp3Zir6cyw==

  • pMRgV18gtLorB21prX4=

  • ukpf+vu2u+hWN5Q=

  • pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==

  • 4fWGzv347bFNDYJeeIHKG5co

  • WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1

  • ZPoM+2U1cwMzteOBsHY=

  • o8jQoNron4sT3A/KomE=

  • 7QX8tTpv/A+YKw==

  • wFvmV8SY/A+YKw==

Targets

    • Target
      hbpuIkG2187U2uC.exe
    • Size 660KB
    • SHA256 849c96dad8e472bb60d06687e6da765c687355295f98348286c25d8d2a9ae613
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbmr1ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks