formbook | cd1a9b8d7f8d830bcb13548fdd9f02a7fae07b7c49fd12bd1a7e02ed346bc010

General

Target
R010543982.exe
Size 912KB
Sample200713-9edmny7vxn
SHA256 cd1a9b8d7f8d830bcb13548fdd9f02a7fae07b7c49fd12bd1a7e02ed346bc010
MD5 d6a9c03b1bbdb0595d8905b80ca73f81
SHA1 5552d7b25059701da5de362f598e7a0329d9beda
SHA512 a2d7609f63eac081cd85365184535975df187509d1a3e21dcd0a2133d6c5a789e909043147d53454299e1bd714a8862fc8196bf1a62dfbd0cf5a4cddfc1c08e9
MD5 SHA1 SHA512

Score

10^/10

persistence spyware trojan stealer formbook evasion

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1308	Explorer.EXE
1308	Explorer.EXE
1308	Explorer.EXE
1308	Explorer.EXE
1308	Explorer.EXE

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	R010543982.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	R010543982.exe

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	608	R010543982.EXE
Token: SeDebugPrivilege	276	msdt.exe
Token: SeShutdownPrivilege	1308	Explorer.EXE

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Hnxplpl\services4hu0efsp.exe	msdt.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
608	R010543982.EXE
608	R010543982.EXE
608	R010543982.EXE
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe
276	msdt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	R010543982.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 608	1104	R010543982.exe	24
PID 608 set thread context of 1308	608	R010543982.EXE	20
PID 608 set thread context of 1308	608	R010543982.EXE	20
PID 276 set thread context of 1308	276	msdt.exe	20

Deletes itself 1 IoCs

pid	Process
288	cmd.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1308	Explorer.EXE
1308	Explorer.EXE
1308	Explorer.EXE
1308	Explorer.EXE

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	msdt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AJLHZLEH = "C:\\Program Files (x86)\\Hnxplpl\\services4hu0efsp.exe"	msdt.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	msdt.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 608	1104	R010543982.exe	24
PID 1104 wrote to memory of 608	1104	R010543982.exe	24
PID 1104 wrote to memory of 608	1104	R010543982.exe	24
PID 1104 wrote to memory of 608	1104	R010543982.exe	24
PID 1104 wrote to memory of 608	1104	R010543982.exe	24
PID 1104 wrote to memory of 608	1104	R010543982.exe	24
PID 1104 wrote to memory of 608	1104	R010543982.exe	24
PID 1308 wrote to memory of 276	1308	Explorer.EXE	36
PID 1308 wrote to memory of 276	1308	Explorer.EXE	36
PID 1308 wrote to memory of 276	1308	Explorer.EXE	36
PID 1308 wrote to memory of 276	1308	Explorer.EXE	36
PID 276 wrote to memory of 288	276	msdt.exe	37
PID 276 wrote to memory of 288	276	msdt.exe	37
PID 276 wrote to memory of 288	276	msdt.exe	37
PID 276 wrote to memory of 288	276	msdt.exe	37

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
608	R010543982.EXE
608	R010543982.EXE
608	R010543982.EXE
608	R010543982.EXE
276	msdt.exe
276	msdt.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\R010543982.exe
  "C:\Users\Admin\AppData\Local\Temp\R010543982.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\R010543982.EXE
    "C:\Users\Admin\AppData\Local\Temp\R010543982.EXE"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:608
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:316
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1408
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1420
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1452
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1436
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1504
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1600
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:832
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:908
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:304
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:800
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetThreadContext
  - Adds Run entry to start application
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: MapViewOfSection
  PID:276
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\R010543982.EXE"
    3⤵
    - Deletes itself
    PID:288