Extracted

• • Target

    QTE000021674.doc

  • Size

    432KB

  • MD5

    520c787857586063238e4684770f9f51

  • SHA1

    bcc10a912754c22eccfc20f8840dd83bbbc40770

  • SHA256

    d5f9868247128595477ac9fb6a5af781853986c05adf9d111b10b59e7fbe962e

  • SHA512

    32bbf81e48a8c71876a9b1ded27245d45ade4ce563b80a168149e1499fd6cb260ab717e304b81b2beb1d056df215713d65feb47094e93fa94707525489cf4d8c

  • SSDEEP

    6144:4wAYwAYwAYwAYwAYwAYwAYwAYwAYwABKeeIeqW:6

  Score

  10^/10

  formbookmw62executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2