formbook | 5e1663a897c64460d68fdf6848b63f589680e75f4d935258a7862b9d1ff617b1

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7
submitted
31/07/2020, 05:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shipping documents, INV+BL.exe
Size 430KB
Sample200731-1h58mdsyea
SHA256 5e1663a897c64460d68fdf6848b63f589680e75f4d935258a7862b9d1ff617b1
MD5 528803eb79a155fc433c390a194ae344
SHA1 3e85abf112dbe5d5cb3b36f82cb5e5aba4f54757
SHA512 b3a29219e6287103d6443ef39891d29b9f95cb72c6b39537c576d7f47fcb53a910fc6d9524a8f90fe26fc42674dedf59b3d39859f0636ed578f16f4fc5a3140d
MD5 SHA1 SHA512

Score

10^/10

rat spyware evasion trojan stealer formbook persistence

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1492	shipping documents, INV+BL.exe
1492	shipping documents, INV+BL.exe
1496	shipping documents, INV+BL.exe
1496	shipping documents, INV+BL.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1496	shipping documents, INV+BL.exe
1496	shipping documents, INV+BL.exe
1496	shipping documents, INV+BL.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe
1864	cmstp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cmstp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BX4DUX18FPGL = "C:\\Program Files (x86)\\Ogho\\igfx1b20.exe"	cmstp.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmstp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	shipping documents, INV+BL.exe
Token: SeDebugPrivilege	1496	shipping documents, INV+BL.exe
Token: SeDebugPrivilege	1864	cmstp.exe
Token: SeShutdownPrivilege	1228	Explorer.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1052	1492	shipping documents, INV+BL.exe	24
PID 1492 wrote to memory of 1052	1492	shipping documents, INV+BL.exe	24
PID 1492 wrote to memory of 1052	1492	shipping documents, INV+BL.exe	24
PID 1492 wrote to memory of 1052	1492	shipping documents, INV+BL.exe	24
PID 1492 wrote to memory of 1496	1492	shipping documents, INV+BL.exe	26
PID 1492 wrote to memory of 1496	1492	shipping documents, INV+BL.exe	26
PID 1492 wrote to memory of 1496	1492	shipping documents, INV+BL.exe	26
PID 1492 wrote to memory of 1496	1492	shipping documents, INV+BL.exe	26
PID 1492 wrote to memory of 1496	1492	shipping documents, INV+BL.exe	26
PID 1492 wrote to memory of 1496	1492	shipping documents, INV+BL.exe	26
PID 1492 wrote to memory of 1496	1492	shipping documents, INV+BL.exe	26
PID 1228 wrote to memory of 1864	1228	Explorer.EXE	32
PID 1228 wrote to memory of 1864	1228	Explorer.EXE	32
PID 1228 wrote to memory of 1864	1228	Explorer.EXE	32
PID 1228 wrote to memory of 1864	1228	Explorer.EXE	32
PID 1228 wrote to memory of 1864	1228	Explorer.EXE	32
PID 1228 wrote to memory of 1864	1228	Explorer.EXE	32
PID 1228 wrote to memory of 1864	1228	Explorer.EXE	32
PID 1864 wrote to memory of 1868	1864	cmstp.exe	33
PID 1864 wrote to memory of 1868	1864	cmstp.exe	33
PID 1864 wrote to memory of 1868	1864	cmstp.exe	33
PID 1864 wrote to memory of 1868	1864	cmstp.exe	33
PID 1864 wrote to memory of 2000	1864	cmstp.exe	38
PID 1864 wrote to memory of 2000	1864	cmstp.exe	38
PID 1864 wrote to memory of 2000	1864	cmstp.exe	38
PID 1864 wrote to memory of 2000	1864	cmstp.exe	38
PID 1864 wrote to memory of 2000	1864	cmstp.exe	38

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1496-5-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1496-5-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1496-6-0x000000000041E2D0-mapping.dmp	formbook
behavioral1/memory/1864-7-0x0000000000000000-mapping.dmp	formbook

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ogho\igfx1b20.exe	cmstp.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1496	1492	shipping documents, INV+BL.exe	26
PID 1496 set thread context of 1228	1496	shipping documents, INV+BL.exe	20
PID 1864 set thread context of 1228	1864	cmstp.exe	20

Deletes itself 1 IoCs

pid	Process
1868	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1052	schtasks.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1228
- C:\Users\Admin\AppData\Local\Temp\shipping documents, INV+BL.exe
  "C:\Users\Admin\AppData\Local\Temp\shipping documents, INV+BL.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:1492
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpABB9.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1052
- - C:\Users\Admin\AppData\Local\Temp\shipping documents, INV+BL.exe
    "{path}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetThreadContext
    PID:1496
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1804
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - Drops file in Program Files directory
  - Suspicious use of SetThreadContext
  PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\shipping documents, INV+BL.exe"
    3⤵
    - Deletes itself
    PID:1868
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-5-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1864-10-0x0000000002F10000-0x0000000002FC3000-memory.dmp

Download

memory/1864-12-0x0000000074BB0000-0x0000000074CCD000-memory.dmp

Download

memory/1864-13-0x0000000003BA0000-0x0000000003D08000-memory.dmp

Download

memory/1864-11-0x00000000750B0000-0x00000000750BC000-memory.dmp

Download

memory/1864-8-0x00000000007B0000-0x00000000007C8000-memory.dmp

Download

memory/2000-15-0x000000013F510000-0x000000013F5A3000-memory.dmp

Download