Overview

overview

10

Static

static

5

P0-92901928.xls

windows7-x64

10

P0-92901928.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    P0-92901928.xls

  • Size

    339KB

  • Sample

    230125-zdkmvsaf98

  • MD5

    6206f3ac6159ce7f8f632d8fb9ccbfaa

  • SHA1

    d862bf89a8ed95704f6c05753de12f4c70504480

  • SHA256

    6f73d6879f3f916f05780e0d90b538cf6d01b976f21620a716e268c672906827

  • SHA512

    5375bad5c042d72d1bd12727fe5400ae014c347532288442545ab6657024d51c4c7017e75854602ebc955cf932e22e7d843f8e25c6bb75c321b1a9fa87990bdf

  • SSDEEP

    6144:Rh0k5eq1h0k5eqnh0k5eOxh0k5eqtZ+RwPONXoRjDhIcp0fDlavx+W26nADW6rUb:Rykdykvyklyk34DYgqk

Score
10/10
formbookw12emacroratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

w12e

Decoy

poshsalon.co.uk

ideeksha.net

eaglebreaks.com

exileine.me.uk

saveittoday.net

ceon.tech

estateagentswebsitedesign.uk

faropublicidade.com

depression-treatment-83678.com

informationdata16376.com

wirecreations.africa

coolsculpting-pros.life

ethoshabitats.com

amtindividual.com

gotoken.online

cherny-100-imec-msu.ru

historicaarcanum.com

gpsarhealthcare.com

kx1257.com

abdullahbinomar.com

Targets

    • Target

      P0-92901928.xls

    • Size

      339KB

    • MD5

      6206f3ac6159ce7f8f632d8fb9ccbfaa

    • SHA1

      d862bf89a8ed95704f6c05753de12f4c70504480

    • SHA256

      6f73d6879f3f916f05780e0d90b538cf6d01b976f21620a716e268c672906827

    • SHA512

      5375bad5c042d72d1bd12727fe5400ae014c347532288442545ab6657024d51c4c7017e75854602ebc955cf932e22e7d843f8e25c6bb75c321b1a9fa87990bdf

    • SSDEEP

      6144:Rh0k5eq1h0k5eqnh0k5eOxh0k5eqtZ+RwPONXoRjDhIcp0fDlavx+W26nADW6rUb:Rykdykvyklyk34DYgqk

    Score
    10/10
    formbookw12eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks