formbook | 261d9ecea1cd1ff4247b59e2d8f2d8ba4484811be97c1cad06f236dadf494139

General

Target
SOA (2).exe
Size 365KB
Sample200804-144sarhcej
SHA256 261d9ecea1cd1ff4247b59e2d8f2d8ba4484811be97c1cad06f236dadf494139
MD5 1ecb4c93d5c380a3634e92b3da14dbea
SHA1 fedd2031f675f7004cc860e95d09176a8085a7b0
SHA512 80c423427a94ae156f7ed59b25b230b8c60475b5e46f8687360dfac1f029502515d57b4846f393d0ae454fdbf5d26adf92b7c88c78c6a64eed75cf7d89c1bdb8
MD5 SHA1 SHA512

Score

10^/10

rat spyware trojan stealer formbook persistence

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3864	SOA (2).exe
3864	SOA (2).exe
3864	SOA (2).exe
3864	SOA (2).exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3864	SOA (2).exe
3864	SOA (2).exe
3864	SOA (2).exe
3984	systray.exe
3984	systray.exe
3984	systray.exe
3984	systray.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Tk8r8or\-zrtrn.exe	systray.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	systray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZL9L_RDX4ZS = "C:\\Program Files (x86)\\Tk8r8or\\-zrtrn.exe"	systray.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	systray.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 3864	792	SOA (2).exe	68
PID 792 wrote to memory of 3864	792	SOA (2).exe	68
PID 792 wrote to memory of 3864	792	SOA (2).exe	68
PID 792 wrote to memory of 3864	792	SOA (2).exe	68
PID 792 wrote to memory of 3864	792	SOA (2).exe	68
PID 792 wrote to memory of 3864	792	SOA (2).exe	68
PID 2964 wrote to memory of 3984	2964	Explorer.EXE	69
PID 2964 wrote to memory of 3984	2964	Explorer.EXE	69
PID 2964 wrote to memory of 3984	2964	Explorer.EXE	69
PID 3984 wrote to memory of 3468	3984	systray.exe	70
PID 3984 wrote to memory of 3468	3984	systray.exe	70
PID 3984 wrote to memory of 3468	3984	systray.exe	70
PID 3984 wrote to memory of 580	3984	systray.exe	76
PID 3984 wrote to memory of 580	3984	systray.exe	76
PID 3984 wrote to memory of 580	3984	systray.exe	76
PID 3984 wrote to memory of 1004	3984	systray.exe	78
PID 3984 wrote to memory of 1004	3984	systray.exe	78
PID 3984 wrote to memory of 1004	3984	systray.exe	78

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 3864	792	SOA (2).exe	68
PID 3864 set thread context of 2964	3864	SOA (2).exe	56
PID 3984 set thread context of 2964	3984	systray.exe	56

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	SOA (2).exe
Token: SeDebugPrivilege	3984	systray.exe
Token: SeShutdownPrivilege	2964	Explorer.EXE
Token: SeCreatePagefilePrivilege	2964	Explorer.EXE
Token: SeShutdownPrivilege	2964	Explorer.EXE
Token: SeCreatePagefilePrivilege	2964	Explorer.EXE

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3864-1-0x000000000041E360-mapping.dmp	formbook
behavioral2/memory/3864-0-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral2/memory/3864-0-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral2/memory/3984-2-0x0000000000000000-mapping.dmp	formbook

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	systray.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2964
- C:\Users\Admin\AppData\Local\Temp\SOA (2).exe
  "C:\Users\Admin\AppData\Local\Temp\SOA (2).exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:792
- - C:\Users\Admin\AppData\Local\Temp\SOA (2).exe
    "C:\Users\Admin\AppData\Local\Temp\SOA (2).exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Drops file in Program Files directory
  - Adds policy Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\SOA (2).exe"
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:580
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-13-0x00007FF757950000-0x00007FF7579E3000-memory.dmp

Download

memory/1004-12-0x00007FF757950000-0x00007FF7579E3000-memory.dmp

Download

memory/1004-11-0x00007FF757950000-0x00007FF7579E3000-memory.dmp

Download

memory/3864-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3984-6-0x0000000001060000-0x000000000112E000-memory.dmp

Download

memory/3984-9-0x0000000005610000-0x000000000569D000-memory.dmp

Download

memory/3984-4-0x0000000001210000-0x0000000001216000-memory.dmp

Download

memory/3984-3-0x0000000001210000-0x0000000001216000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads