Overview

overview

10

Static

static

1

DHL STATEM...NT.xls

windows7-x64

10

DHL STATEM...NT.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL STATEMENT OF ACCOUNT.xls

  • Size

    1.0MB

  • Sample

    230404-stnacsaa9t

  • MD5

    628e94549cd48390032b9c3e5dcf9d85

  • SHA1

    fe6e6a48c1d72950d00d9b61c6a336d2f15ed4f7

  • SHA256

    b7a66f850f21e75d9e4dfb0deaacc0426436b99e9b98a825d6a3cec94988a736

  • SHA512

    7f924c7eccdb62b8e8b2c25e14dda617876ad23a8fca94e6185bf37009279cac015042f4ffe3485de1adc2160d5f951a3eac66f29b01dcb5c6bef8e2c7496500

  • SSDEEP

    12288:M8aFiKXKlcqUu9VnewiiDArDqUu9VneqqUu9VneYilPArgqUu9VneIArpJdx1sx1:SLKlKu9Vmu9V/u9Veu9VyT2x6w

Score
10/10
formbookar73ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ar73

Decoy

classgorilla.com

b6817.com

1wwuwa.top

dgslimited.africa

deepwaterships.com

hkshshoptw.shop

hurricanevalleyatvjamboree.com

ckpconsulting.com

laojiangmath.com

authenticityhacking.com

family-doctor-53205.com

investinstgeorgeut.com

lithoearthsolution.africa

quickhealcareltd.co.uk

delightkgrillw.top

freezeclosettoilet.com

coo1star.com

gemgamut.com

enrichednetworksolutions.com

betterbeeclean.com

Targets

    • Target

      DHL STATEMENT OF ACCOUNT.xls

    • Size

      1.0MB

    • MD5

      628e94549cd48390032b9c3e5dcf9d85

    • SHA1

      fe6e6a48c1d72950d00d9b61c6a336d2f15ed4f7

    • SHA256

      b7a66f850f21e75d9e4dfb0deaacc0426436b99e9b98a825d6a3cec94988a736

    • SHA512

      7f924c7eccdb62b8e8b2c25e14dda617876ad23a8fca94e6185bf37009279cac015042f4ffe3485de1adc2160d5f951a3eac66f29b01dcb5c6bef8e2c7496500

    • SSDEEP

      12288:M8aFiKXKlcqUu9VnewiiDArDqUu9VneqqUu9VneYilPArgqUu9VneIArpJdx1sx1:SLKlKu9Vmu9V/u9Veu9VyT2x6w

    Score
    10/10
    formbookar73ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

3
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks