formbook | 528855cf41335ffa3099457ea280c63afba531ec224b3c3ee9eb293b369db220

General

Target
RFQ-PO#40062.exe
Size 505KB
Sample200624-pl2fexlk2e
SHA256 528855cf41335ffa3099457ea280c63afba531ec224b3c3ee9eb293b369db220
MD5 d7fe417e0330a172af1bce5d99e9e1cd
SHA1 1ee040a6168532f78584e51bc07e3df2fc1ae796
SHA512 1257b0a6aa3594c06894963475254061bc239a0911d76eca392b37d484954670750e9ca82e5041e94c1ba7747ffb8c146e0378a8c9bb0544cc0bb3ca186aa6bb
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of SendNotifyMessage 4 IoCs

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run entry to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	chkdsk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8PKXHTYXYR = "C:\\Program Files (x86)\\Dmdvpl4r8\\mfcebvhjrz.exe"	chkdsk.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1672	888	RFQ-PO#40062.exe	26
PID 888 wrote to memory of 1672	888	RFQ-PO#40062.exe	26
PID 888 wrote to memory of 1672	888	RFQ-PO#40062.exe	26
PID 888 wrote to memory of 1672	888	RFQ-PO#40062.exe	26
PID 888 wrote to memory of 1672	888	RFQ-PO#40062.exe	26
PID 888 wrote to memory of 1672	888	RFQ-PO#40062.exe	26
PID 888 wrote to memory of 1672	888	RFQ-PO#40062.exe	26
PID 1296 wrote to memory of 1244	1296	Explorer.EXE	27
PID 1296 wrote to memory of 1244	1296	Explorer.EXE	27
PID 1296 wrote to memory of 1244	1296	Explorer.EXE	27
PID 1296 wrote to memory of 1244	1296	Explorer.EXE	27
PID 1244 wrote to memory of 1808	1244	chkdsk.exe	28
PID 1244 wrote to memory of 1808	1244	chkdsk.exe	28
PID 1244 wrote to memory of 1808	1244	chkdsk.exe	28
PID 1244 wrote to memory of 1808	1244	chkdsk.exe	28

Deletes itself 1 IoCs

pid	Process
1808	cmd.exe

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious behavior: MapViewOfSection 5 IoCs

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Dmdvpl4r8\mfcebvhjrz.exe	chkdsk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	chkdsk.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 888 set thread context of 1672	888	RFQ-PO#40062.exe	26
PID 1672 set thread context of 1296	1672	RFQ-PO#40062.exe	20
PID 1244 set thread context of 1296	1244	chkdsk.exe	20

Suspicious behavior: EnumeratesProcesses 22 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	RFQ-PO#40062.exe
Token: SeDebugPrivilege	1244	chkdsk.exe

Suspicious use of FindShellTrayWindow 4 IoCs