formbook | c79a75bdb7f50439434aef1de18f5eaa857b9c0affd00f8e40ef85348df6cf57

General

Target
Transfer Form Doc.exe
Size 770KB
Sample200717-1137chgnge
SHA256 c79a75bdb7f50439434aef1de18f5eaa857b9c0affd00f8e40ef85348df6cf57
MD5 3f4742e81a0164ade93a7be29666511f
SHA1 dd1e38c7dcaddd66f0bf79b3be047afed2773901
SHA512 506e808747721a122ab0ba420f51dfa28dcbe1e3f9adcc79b6955b06cf54ee2cefd4ee32fe7574faad2375d226d2ac474c625e48f63a87e81b79600bf66e860a
MD5 SHA1 SHA512

Score

10^/10

evasion trojan spyware stealer formbook persistence

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	Transfer Form Doc.exe
Token: SeDebugPrivilege	644	Transfer Form Doc.exe
Token: SeDebugPrivilege	600	raserver.exe
Token: SeShutdownPrivilege	1324	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1124	Transfer Form Doc.exe
644	Transfer Form Doc.exe
644	Transfer Form Doc.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe

Deletes itself 1 IoCs

pid	Process
1112	cmd.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE
1324	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1496	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1496	1124	Transfer Form Doc.exe	24
PID 1124 wrote to memory of 1496	1124	Transfer Form Doc.exe	24
PID 1124 wrote to memory of 1496	1124	Transfer Form Doc.exe	24
PID 1124 wrote to memory of 1496	1124	Transfer Form Doc.exe	24
PID 1124 wrote to memory of 644	1124	Transfer Form Doc.exe	26
PID 1124 wrote to memory of 644	1124	Transfer Form Doc.exe	26
PID 1124 wrote to memory of 644	1124	Transfer Form Doc.exe	26
PID 1124 wrote to memory of 644	1124	Transfer Form Doc.exe	26
PID 1124 wrote to memory of 644	1124	Transfer Form Doc.exe	26
PID 1124 wrote to memory of 644	1124	Transfer Form Doc.exe	26
PID 1124 wrote to memory of 644	1124	Transfer Form Doc.exe	26
PID 1324 wrote to memory of 600	1324	Explorer.EXE	27
PID 1324 wrote to memory of 600	1324	Explorer.EXE	27
PID 1324 wrote to memory of 600	1324	Explorer.EXE	27
PID 1324 wrote to memory of 600	1324	Explorer.EXE	27
PID 600 wrote to memory of 1112	600	raserver.exe	28
PID 600 wrote to memory of 1112	600	raserver.exe	28
PID 600 wrote to memory of 1112	600	raserver.exe	28
PID 600 wrote to memory of 1112	600	raserver.exe	28
PID 600 wrote to memory of 1960	600	raserver.exe	33
PID 600 wrote to memory of 1960	600	raserver.exe	33
PID 600 wrote to memory of 1960	600	raserver.exe	33
PID 600 wrote to memory of 1960	600	raserver.exe	33
PID 600 wrote to memory of 1960	600	raserver.exe	33

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 644	1124	Transfer Form Doc.exe	26
PID 644 set thread context of 1324	644	Transfer Form Doc.exe	20
PID 600 set thread context of 1324	600	raserver.exe	20

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	raserver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\J0A4ANSH7V = "C:\\Program Files (x86)\\Pxrg4hxm\\audiodgtdv.exe"	raserver.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
644	Transfer Form Doc.exe
644	Transfer Form Doc.exe
644	Transfer Form Doc.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe
600	raserver.exe

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Pxrg4hxm\audiodgtdv.exe	raserver.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\Transfer Form Doc.exe
  "C:\Users\Admin\AppData\Local\Temp\Transfer Form Doc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:1124
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kBLmdzHF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9942.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Transfer Form Doc.exe
    "{path}"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:644
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Adds Run key to start application
  - Suspicious behavior: MapViewOfSection
  - Drops file in Program Files directory
  PID:600
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Transfer Form Doc.exe"
    3⤵
    - Deletes itself
    PID:1112
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1960