formbook

General

Target

Order List_28_11_22.cab
Size

226KB
Sample

221128-p45qlsea27
MD5

065c59b16901bcd8457ed32e523a245a
SHA1

4a41e441848649e470f8fbb3f32055b342bc9d4d
SHA256

6dd9b4ea062adbbdbf5c3dd5eeb6c839fd9fdc497aa4228c02b59bb1a505a560
SHA512

0ddcbad1f1fa96eb11549aaf18da09b9764ecd07d0df7e7a2408b7b22c777454e599992dd8c12815a69266fca299c1e1dc8a2c7e58831f5da5d5d44f408f3096
SSDEEP

6144:LQgq+5MmNB22lQdXlFGBm5BmO1vCRpuGOE2I:LQY2Qo1wBm5vGOE2I

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

n2hm

Decoy

XCeG4IxNKbAl

YzJWbnC+El84nA==

KAJcdmP8yEcO5LXPCFF42Wfb

I+J+xYO95GJQWVU=

GtgxPPv3FmQmhw==

Og9NYF4xEl+j7vGTR93xvg==

506Cg07bsT0G6yK+A96H0h35V+JLkwI=

wAYXFN+pSFIXgQ==

ijzLI/f+FmQmhw==

UfT2PweNm+w8

GQWVw5aZnfF/kS5e

30BKYjua9zcA7gAwsPUngLnjyrBNEgo=

AM65OrmyFmQmhw==

VSlTVxISZ4J/kS5e

GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==

B9H98cUUfX+AWOqiTA==

MxVffWOIoVnM37zrd2sTaOY=

z6bxCgG/mGhR7oDzQA==

pQgSLSRi6AK3M/PdArpX

6rRRsYuSnXx/kS5e

Targets

- Target
  
  Order List_28_11_22.exe
- Size
  
  239KB
- MD5
  
  0acb5bcb968b08f9fa0275337eaf9d81
- SHA1
  
  9ff40194659288c71ee7ff01435eac29d5d55004
- SHA256
  
  2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc
- SHA512
  
  a6c9ee59f120f5400ea08726337ed52d982184d71809f12255f44643fb6170e996a0bd89b5465b6498854978e0acab09e7cb7d6b912bcd1396e848392b1e986a
- SSDEEP
  
  6144:QBn1gQ5lYu+gRaCuvlFMC5oTlyEwP5Od6mcELn3Wm:ggQ4DgRaxL5oJmP5O3jmm
Score

10^/10

formbook n2hm rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2