formbook | cd1a9b8d7f8d830bcb13548fdd9f02a7fae07b7c49fd12bd1a7e02ed346bc010

Analysis

max time kernel
146s
max time network
142s
platform
windows10_x64
resource
win10v200430
submitted
13/07/2020, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
R010543982.exe
Size 912KB
Sample200713-9edmny7vxn
SHA256 cd1a9b8d7f8d830bcb13548fdd9f02a7fae07b7c49fd12bd1a7e02ed346bc010
MD5 d6a9c03b1bbdb0595d8905b80ca73f81
SHA1 5552d7b25059701da5de362f598e7a0329d9beda
SHA512 a2d7609f63eac081cd85365184535975df187509d1a3e21dcd0a2133d6c5a789e909043147d53454299e1bd714a8862fc8196bf1a62dfbd0cf5a4cddfc1c08e9
MD5 SHA1 SHA512

Score

10^/10

trojan spyware stealer formbook persistence

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\B9rchsh8\crlxfl67xn.exe	mstsc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mstsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	R010543982.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2120	2016	R010543982.exe	68
PID 2016 wrote to memory of 2120	2016	R010543982.exe	68
PID 2016 wrote to memory of 2120	2016	R010543982.exe	68
PID 2016 wrote to memory of 2120	2016	R010543982.exe	68
PID 2016 wrote to memory of 2120	2016	R010543982.exe	68
PID 2016 wrote to memory of 2120	2016	R010543982.exe	68
PID 3012 wrote to memory of 3680	3012	Explorer.EXE	70
PID 3012 wrote to memory of 3680	3012	Explorer.EXE	70
PID 3012 wrote to memory of 3680	3012	Explorer.EXE	70
PID 3680 wrote to memory of 2528	3680	mstsc.exe	74
PID 3680 wrote to memory of 2528	3680	mstsc.exe	74
PID 3680 wrote to memory of 2528	3680	mstsc.exe	74
PID 3680 wrote to memory of 3908	3680	mstsc.exe	76
PID 3680 wrote to memory of 3908	3680	mstsc.exe	76
PID 3680 wrote to memory of 3908	3680	mstsc.exe	76

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 2120	2016	R010543982.exe	68
PID 2120 set thread context of 3012	2120	R010543982.EXE	55
PID 3680 set thread context of 3012	3680	mstsc.exe	55

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	R010543982.EXE
Token: SeDebugPrivilege	3680	mstsc.exe
Token: SeShutdownPrivilege	3012	Explorer.EXE
Token: SeCreatePagefilePrivilege	3012	Explorer.EXE
Token: SeShutdownPrivilege	3012	Explorer.EXE
Token: SeCreatePagefilePrivilege	3012	Explorer.EXE
Token: SeShutdownPrivilege	3012	Explorer.EXE
Token: SeCreatePagefilePrivilege	3012	Explorer.EXE
Token: SeShutdownPrivilege	3012	Explorer.EXE
Token: SeCreatePagefilePrivilege	3012	Explorer.EXE
Token: SeShutdownPrivilege	3012	Explorer.EXE
Token: SeCreatePagefilePrivilege	3012	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2120	R010543982.EXE
2120	R010543982.EXE
2120	R010543982.EXE
3680	mstsc.exe
3680	mstsc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	R010543982.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	R010543982.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2120	R010543982.EXE
2120	R010543982.EXE
2120	R010543982.EXE
2120	R010543982.EXE
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe
3680	mstsc.exe

js 2 IoCs

resource	yara_rule
behavioral2/memory/3680-6-0x0000000000F00000-0x00000000011FC000-memory.dmp	js
behavioral2/memory/3680-7-0x0000000000F00000-0x00000000011FC000-memory.dmp	js

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T8TPBTBPVF = "C:\\Program Files (x86)\\B9rchsh8\\crlxfl67xn.exe"	mstsc.exe
Key created	\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	mstsc.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3012
- C:\Users\Admin\AppData\Local\Temp\R010543982.exe
  "C:\Users\Admin\AppData\Local\Temp\R010543982.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Maps connected drives based on registry
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\R010543982.EXE
    "C:\Users\Admin\AppData\Local\Temp\R010543982.EXE"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: MapViewOfSection
    - Suspicious behavior: EnumeratesProcesses
    PID:2120
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: EnumeratesProcesses
  - Adds Run entry to start application
  PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\R010543982.EXE"
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:3908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-2-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3680-6-0x0000000000F00000-0x00000000011FC000-memory.dmp

Download

memory/3680-9-0x0000000005890000-0x0000000005A04000-memory.dmp

Download

memory/3680-7-0x0000000000F00000-0x00000000011FC000-memory.dmp

Download