formbook | d76bb689a401094eee47a075368224161d261665c2b285b155d1b7833ba4fbaa

General

Target

oOT3aykttE5iZZq.exe
Size

616KB
MD5

2f7ba4389cda2fda6b04c239b26ef587
SHA1

83ce7c55e750880c0ef16567bfe017aa28ba3b14
SHA256

d76bb689a401094eee47a075368224161d261665c2b285b155d1b7833ba4fbaa
SHA512

cc868f319e1f46619ca857c16bd7e9930d2971e2f029a9137d3f1f4dc2a51afbe233dc1ee4bf6a0b32cec321ceb6c9ec02bf3e03ce2ed36e0cc113443c347dcf

Score

10^/10

persistence spyware trojan stealer formbook

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cmmon32.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmmon32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3864 schtasks.exe

pid	process
3864	schtasks.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

oOT3aykttE5iZZq.exeoOT3aykttE5iZZq.execmmon32.exe

description	pid	process	target process
PID 3580 set thread context of 3928	3580	oOT3aykttE5iZZq.exe	oOT3aykttE5iZZq.exe
PID 3928 set thread context of 2976	3928	oOT3aykttE5iZZq.exe	Explorer.EXE
PID 3928 set thread context of 2976	3928	oOT3aykttE5iZZq.exe	Explorer.EXE
PID 4000 set thread context of 2976	4000	cmmon32.exe	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

oOT3aykttE5iZZq.execmmon32.exe

pid process

3928 oOT3aykttE5iZZq.exe
3928 oOT3aykttE5iZZq.exe
3928 oOT3aykttE5iZZq.exe
3928 oOT3aykttE5iZZq.exe
4000 cmmon32.exe
4000 cmmon32.exe
Drops file in Program Files directory 1 IoCs

Processes:

cmmon32.exe

description ioc process

File opened for modification C:\Program Files (x86)\Lppkdul\msobmlqh.exe cmmon32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Lppkdul\msobmlqh.exe	cmmon32.exe

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cmmon32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cmmon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\PV1LGHTXEL8 = "C:\\Program Files (x86)\\Lppkdul\\msobmlqh.exe"	cmmon32.exe

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

oOT3aykttE5iZZq.exeExplorer.EXEcmmon32.exe

description	pid	process	target process
PID 3580 wrote to memory of 3864	3580	oOT3aykttE5iZZq.exe	schtasks.exe
PID 3580 wrote to memory of 3864	3580	oOT3aykttE5iZZq.exe	schtasks.exe
PID 3580 wrote to memory of 3864	3580	oOT3aykttE5iZZq.exe	schtasks.exe
PID 3580 wrote to memory of 3928	3580	oOT3aykttE5iZZq.exe	oOT3aykttE5iZZq.exe
PID 3580 wrote to memory of 3928	3580	oOT3aykttE5iZZq.exe	oOT3aykttE5iZZq.exe
PID 3580 wrote to memory of 3928	3580	oOT3aykttE5iZZq.exe	oOT3aykttE5iZZq.exe
PID 3580 wrote to memory of 3928	3580	oOT3aykttE5iZZq.exe	oOT3aykttE5iZZq.exe
PID 3580 wrote to memory of 3928	3580	oOT3aykttE5iZZq.exe	oOT3aykttE5iZZq.exe
PID 3580 wrote to memory of 3928	3580	oOT3aykttE5iZZq.exe	oOT3aykttE5iZZq.exe
PID 2976 wrote to memory of 4000	2976	Explorer.EXE	cmmon32.exe
PID 2976 wrote to memory of 4000	2976	Explorer.EXE	cmmon32.exe
PID 2976 wrote to memory of 4000	2976	Explorer.EXE	cmmon32.exe
PID 4000 wrote to memory of 3408	4000	cmmon32.exe	cmd.exe
PID 4000 wrote to memory of 3408	4000	cmmon32.exe	cmd.exe
PID 4000 wrote to memory of 3408	4000	cmmon32.exe	cmd.exe
PID 4000 wrote to memory of 3816	4000	cmmon32.exe	cmd.exe
PID 4000 wrote to memory of 3816	4000	cmmon32.exe	cmd.exe
PID 4000 wrote to memory of 3816	4000	cmmon32.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

oOT3aykttE5iZZq.execmmon32.exe

pid	process
3928	oOT3aykttE5iZZq.exe
3928	oOT3aykttE5iZZq.exe
3928	oOT3aykttE5iZZq.exe
3928	oOT3aykttE5iZZq.exe
3928	oOT3aykttE5iZZq.exe
3928	oOT3aykttE5iZZq.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe
4000	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

oOT3aykttE5iZZq.execmmon32.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3928	oOT3aykttE5iZZq.exe
Token: SeDebugPrivilege	4000	cmmon32.exe
Token: SeShutdownPrivilege	2976	Explorer.EXE
Token: SeCreatePagefilePrivilege	2976	Explorer.EXE
Token: SeShutdownPrivilege	2976	Explorer.EXE
Token: SeCreatePagefilePrivilege	2976	Explorer.EXE
Token: SeShutdownPrivilege	2976	Explorer.EXE
Token: SeCreatePagefilePrivilege	2976	Explorer.EXE
Token: SeShutdownPrivilege	2976	Explorer.EXE
Token: SeCreatePagefilePrivilege	2976	Explorer.EXE

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

cmmon32.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmmon32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cmmon32.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Users\Admin\AppData\Local\Temp\oOT3aykttE5iZZq.exe
"C:\Users\Admin\AppData\Local\Temp\oOT3aykttE5iZZq.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnNdfcFfD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7E53.tmp"
3⤵
- Creates scheduled task(s)
PID:3864

C:\Users\Admin\AppData\Local\Temp\oOT3aykttE5iZZq.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4000

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\oOT3aykttE5iZZq.exe"
3⤵
PID:3408

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:3816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DB1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7E53.tmp

Download Submit
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logim.jpeg

Download Submit
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrg.ini

Download Submit
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logri.ini

Download Submit
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrv.ini

Download Submit
memory/2976-9-0x0000000006200000-0x0000000006398000-memory.dmp

Filesize
1.6MB

Download
memory/3408-7-0x0000000000000000-mapping.dmp

Download
memory/3816-11-0x0000000000000000-mapping.dmp

Download
memory/3864-0-0x0000000000000000-mapping.dmp

Download
memory/3928-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3928-3-0x000000000041B6E0-mapping.dmp

Download
memory/4000-4-0x0000000000000000-mapping.dmp

Download
memory/4000-8-0x0000000005540000-0x000000000565D000-memory.dmp

Filesize
1.1MB

Download
memory/4000-6-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/4000-5-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads