Extracted

• • Target
    Septorder.doc
  • Size 634KB
  • SHA256 7b6a3f5f885e00679f66af1168236c12b3db888689fe8bb7879f994f4160c352
  • MD5 4c8e90937a0516f48aa3b8cb17cbc7b8
  • SHA1 89b8ff3dbb714d2ff658e0c09a65dbc590e19da4
  • SHA512 84be326e914937e3ebf91824d701de5b2c14d4f4e30dd0b0f6d571f99ceebbd24e6ed947d748e084ac3fe69cca1e43f21b64793cb63130fe5a969917b9314391
  • SSDEEP 6144:bwAYwAYwAYwAYwAY9A3i0AJW6fiI5zXaW:+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookbopidiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2