formbook | 3490dfb2560aed5d468605fbba8d770eeee2a336de3fd7e4a18f22afcad5bc44

General

Target
0zraDXiYQMs3XWK.exe
Size 423KB
Sample200703-e8z2w23sa2
SHA256 3490dfb2560aed5d468605fbba8d770eeee2a336de3fd7e4a18f22afcad5bc44
MD5 cf54f5dac9665d74175ffea91e353789
SHA1 7d3e2706933adc26d630b48ad7bceaf035a3fe06
SHA512 a0a2be7c3848f660837125370b5616ee61e03c6e16f5251b3326072bdcafe8a90ed760c19b5bea3581a376851bffe15bb9fb28c518e409c50887f931102de466
MD5 SHA1 SHA512

Score

10^/10

persistence spyware evasion trojan stealer formbook

Malware Config

Signatures

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 1860	1388	0zraDXiYQMs3XWK.exe	28
PID 1860 set thread context of 1240	1860	0zraDXiYQMs3XWK.exe	20
PID 1872 set thread context of 1240	1872	svchost.exe	20

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\M1b6hzl5\configztx4.exe	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1816	1388	0zraDXiYQMs3XWK.exe	26
PID 1388 wrote to memory of 1816	1388	0zraDXiYQMs3XWK.exe	26
PID 1388 wrote to memory of 1816	1388	0zraDXiYQMs3XWK.exe	26
PID 1388 wrote to memory of 1816	1388	0zraDXiYQMs3XWK.exe	26
PID 1388 wrote to memory of 1860	1388	0zraDXiYQMs3XWK.exe	28
PID 1388 wrote to memory of 1860	1388	0zraDXiYQMs3XWK.exe	28
PID 1388 wrote to memory of 1860	1388	0zraDXiYQMs3XWK.exe	28
PID 1388 wrote to memory of 1860	1388	0zraDXiYQMs3XWK.exe	28
PID 1388 wrote to memory of 1860	1388	0zraDXiYQMs3XWK.exe	28
PID 1388 wrote to memory of 1860	1388	0zraDXiYQMs3XWK.exe	28
PID 1388 wrote to memory of 1860	1388	0zraDXiYQMs3XWK.exe	28
PID 1240 wrote to memory of 1872	1240	Explorer.EXE	29
PID 1240 wrote to memory of 1872	1240	Explorer.EXE	29
PID 1240 wrote to memory of 1872	1240	Explorer.EXE	29
PID 1240 wrote to memory of 1872	1240	Explorer.EXE	29
PID 1872 wrote to memory of 1760	1872	svchost.exe	30
PID 1872 wrote to memory of 1760	1872	svchost.exe	30
PID 1872 wrote to memory of 1760	1872	svchost.exe	30
PID 1872 wrote to memory of 1760	1872	svchost.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	0zraDXiYQMs3XWK.exe
Token: SeDebugPrivilege	1872	svchost.exe

Deletes itself 1 IoCs

pid	Process
1760	cmd.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VNUP5NCXQ = "C:\\Program Files (x86)\\M1b6hzl5\\configztx4.exe"	svchost.exe
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	svchost.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1860	0zraDXiYQMs3XWK.exe
1860	0zraDXiYQMs3XWK.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe
1872	svchost.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1860	0zraDXiYQMs3XWK.exe
1860	0zraDXiYQMs3XWK.exe
1860	0zraDXiYQMs3XWK.exe
1872	svchost.exe
1872	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1816	schtasks.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1240
- C:\Users\Admin\AppData\Local\Temp\0zraDXiYQMs3XWK.exe
  "C:\Users\Admin\AppData\Local\Temp\0zraDXiYQMs3XWK.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nmvlgPGKLOouDy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF93C.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\0zraDXiYQMs3XWK.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1860
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Adds Run entry to start application
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1872
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\0zraDXiYQMs3XWK.exe"
    3⤵
    - Deletes itself
    PID:1760