General
- Target 29062026_1621_29062026_Mv_Meritius_Requisition_Form.gz
- Size 2.2MB
- Sample260629-ttpzmahw7w
- SHA256 30a4a14d5eed6dd54d672a8a8b102912008827d31189d9dc9c6aa1e4f66ba855
Score
10/10
Malware Config
Targets
-
- Target Mv_Meritius_Requisition_Form.exe
- Size 3.9MB
- SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Accesses Microsoft Outlook profiles
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of SetThreadContext
-
- Target Secur32.dll
- Size 2.1MB
- SHA256 f8a7fd3580f7a79db3be7feb8f1519e38058977a7b50cae698260a487e815475
Score7/10-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1