Extracted

• • Target
    QTE000021674.doc
  • Size 432KB
  • SHA256 d5f9868247128595477ac9fb6a5af781853986c05adf9d111b10b59e7fbe962e
  • MD5 520c787857586063238e4684770f9f51
  • SHA1 bcc10a912754c22eccfc20f8840dd83bbbc40770
  • SHA512 32bbf81e48a8c71876a9b1ded27245d45ade4ce563b80a168149e1499fd6cb260ab717e304b81b2beb1d056df215713d65feb47094e93fa94707525489cf4d8c
  • SSDEEP 6144:4wAYwAYwAYwAYwAYwAYwAYwAYwAYwABKeeIeqW:6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmw62executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2