formbook | d0604fe76ff35e2311825f1822171208bd472c764dfbdbf45e20fad47f6a4472

General

Target
Invoice For H sbc Payment Instruction.exe
Size 340KB
Sample200715-tajf5fb596
SHA256 d0604fe76ff35e2311825f1822171208bd472c764dfbdbf45e20fad47f6a4472
MD5 d94d1332d48398914da9f4b343c528e2
SHA1 8743bccc3cd8c5732470d831f90e614764068171
SHA512 33b1548584a316cb09bacfbb79bbce37800eb62441459766a75e943789c1c74bd991c549bc456a010826e87823145912f22ea9f3c6e745696c26b4066b48f5d0
MD5 SHA1 SHA512

Score

10^/10

spyware evasion trojan stealer formbook persistence

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	Invoice For H sbc Payment Instruction.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 836 set thread context of 1324	836	RegAsm.exe	20
PID 1312 set thread context of 1324	1312	wininit.exe	20

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	RegAsm.exe
Token: SeDebugPrivilege	1312	wininit.exe
Token: SeShutdownPrivilege	1324	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\A6lgd7bmx\mswbphud.exe	wininit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	wininit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LRG4DXHPEZY = "C:\\Program Files (x86)\\A6lgd7bmx\\mswbphud.exe"	wininit.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1124	Invoice For H sbc Payment Instruction.exe
836	RegAsm.exe
836	RegAsm.exe
836	RegAsm.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
836	RegAsm.exe
836	RegAsm.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe
1312	wininit.exe

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 1124 wrote to memory of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 1124 wrote to memory of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 1124 wrote to memory of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 1124 wrote to memory of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 1124 wrote to memory of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 1124 wrote to memory of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 1124 wrote to memory of 836	1124	Invoice For H sbc Payment Instruction.exe	24
PID 1324 wrote to memory of 1312	1324	Explorer.EXE	25
PID 1324 wrote to memory of 1312	1324	Explorer.EXE	25
PID 1324 wrote to memory of 1312	1324	Explorer.EXE	25
PID 1324 wrote to memory of 1312	1324	Explorer.EXE	25
PID 1312 wrote to memory of 1440	1312	wininit.exe	26
PID 1312 wrote to memory of 1440	1312	wininit.exe	26
PID 1312 wrote to memory of 1440	1312	wininit.exe	26
PID 1312 wrote to memory of 1440	1312	wininit.exe	26
PID 1312 wrote to memory of 1560	1312	wininit.exe	31
PID 1312 wrote to memory of 1560	1312	wininit.exe	31
PID 1312 wrote to memory of 1560	1312	wininit.exe	31
PID 1312 wrote to memory of 1560	1312	wininit.exe	31
PID 1312 wrote to memory of 1560	1312	wininit.exe	31

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wininit.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1324
- C:\Users\Admin\AppData\Local\Temp\Invoice For H sbc Payment Instruction.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice For H sbc Payment Instruction.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: MapViewOfSection
    - Suspicious behavior: EnumeratesProcesses
    PID:836
- C:\Windows\SysWOW64\wininit.exe
  "C:\Windows\SysWOW64\wininit.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Drops file in Program Files directory
  - Adds Run key to start application
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - Modifies Internet Explorer settings
  PID:1312
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1440
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1312-8-0x0000000076E30000-0x0000000076F8C000-memory.dmp

Download

memory/1312-7-0x00000000761C0000-0x00000000762DD000-memory.dmp

Download

memory/1312-6-0x0000000076C90000-0x0000000076C9C000-memory.dmp

Download

memory/1312-14-0x0000000003740000-0x0000000003828000-memory.dmp

Download

memory/1312-5-0x0000000002E90000-0x0000000002F4B000-memory.dmp

Download

memory/1312-3-0x00000000005A0000-0x00000000005BA000-memory.dmp

Download

memory/1560-16-0x000000013F710000-0x000000013F7A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads