formbook | e99c6ae5a08e119d151f0c28b6b164d98ca6fd24d1d91b6f57bdf40f3d688c91

General

Target
Spare Parts Request MV Accord 8.13.20_pdf.exe
Size 750KB
Sample200813-dhs2bn6blx
SHA256 e99c6ae5a08e119d151f0c28b6b164d98ca6fd24d1d91b6f57bdf40f3d688c91
MD5 c1711ee7d080374845cecb35060eb0f8
SHA1 893df8e1438a37deb903484486579f86a43bfd9f
SHA512 d85059122768ce448a86415e6449c93640da77d6207efa58c634baa35d410fcc70432f2a0b5c9af624d13afdb511597a57970f6219ab1beb036f6718925115f8
MD5 SHA1 SHA512

Score

10^/10

rat persistence spyware trojan stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.lodipytu.com/xla/

Decoy

v-jig.com
uniplaceservices.com
yolovely.com
demonoscarclub.com
jayanthallumalla.com
ngonclub.biz
mckendreedesign.com
acesandeightsdj.info
740manbetx.com
yiwulewo.com
wcc.ink
fkkha.info
btnij.com
pharmacyinfinitedata.com
marakez.online
sgpcrm.com
archive-fast-quick.date
akproductionstudio.studio
bfbrjgw.com
fjshuguan.com
zhuoyu-china.com
forumlingerie.com
gifplatform.com
vitelstars-pasangan.site
vbmsy.info
selmaspa.net
gardenorr.net
flight.ltd
yaredaijifeng.com
deepscanner.net
bridgeandbroadcast.com
picare247.com
worldlovepoem.net
keppkn.com
jikueyvoutpeeping.review
cgultkd.com
lqbus.com
hotelssydney.online
nodirectionrocks.com
existential.world
pacenet.healthcare
louisvoyage.com
netbankkontol.com
360vrcommunity.com
23northgroup.com
islom-karimov.site
weirucheng.com
izzhome.com
photozil.com
iexmyf.info
caperecifemusicfestival.com
art-yoshidamachi.com
whoperty.com
breakmyheart.supply
brasserielebistro.com
suizku.com
academywrap.com
shsn69.com
brookeforgovernor.com
charlestonmetrohouses.com
brenneraccounting.net
fulewang.net
saludarailtrail.com
start.lease

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1588-0-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1588-0-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1588-1-0x000000000041E2B0-mapping.dmp	formbook
behavioral1/memory/272-2-0x0000000000000000-mapping.dmp	formbook

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XXWT4RBPT = "C:\\Program Files (x86)\\Hsdf0q\\serviceskx4dv4i.exe"	wscript.exe

Deletes itself 1 IoCs

pid	Process
1108	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1588	1492	Spare Parts Request MV Accord 8.13.20_pdf.exe	24
PID 1588 set thread context of 1228	1588	Spare Parts Request MV Accord 8.13.20_pdf.exe	20
PID 272 set thread context of 1228	272	wscript.exe	20

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Hsdf0q\serviceskx4dv4i.exe	wscript.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wscript.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1492	Spare Parts Request MV Accord 8.13.20_pdf.exe
1588	Spare Parts Request MV Accord 8.13.20_pdf.exe
1588	Spare Parts Request MV Accord 8.13.20_pdf.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1492	Spare Parts Request MV Accord 8.13.20_pdf.exe
1588	Spare Parts Request MV Accord 8.13.20_pdf.exe
1588	Spare Parts Request MV Accord 8.13.20_pdf.exe
1588	Spare Parts Request MV Accord 8.13.20_pdf.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe
272	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	Spare Parts Request MV Accord 8.13.20_pdf.exe
Token: SeDebugPrivilege	272	wscript.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1588	1492	Spare Parts Request MV Accord 8.13.20_pdf.exe	24
PID 1492 wrote to memory of 1588	1492	Spare Parts Request MV Accord 8.13.20_pdf.exe	24
PID 1492 wrote to memory of 1588	1492	Spare Parts Request MV Accord 8.13.20_pdf.exe	24
PID 1492 wrote to memory of 1588	1492	Spare Parts Request MV Accord 8.13.20_pdf.exe	24
PID 1228 wrote to memory of 272	1228	Explorer.EXE	28
PID 1228 wrote to memory of 272	1228	Explorer.EXE	28
PID 1228 wrote to memory of 272	1228	Explorer.EXE	28
PID 1228 wrote to memory of 272	1228	Explorer.EXE	28
PID 272 wrote to memory of 1108	272	wscript.exe	29
PID 272 wrote to memory of 1108	272	wscript.exe	29
PID 272 wrote to memory of 1108	272	wscript.exe	29
PID 272 wrote to memory of 1108	272	wscript.exe	29
PID 272 wrote to memory of 1536	272	wscript.exe	34
PID 272 wrote to memory of 1536	272	wscript.exe	34
PID 272 wrote to memory of 1536	272	wscript.exe	34
PID 272 wrote to memory of 1536	272	wscript.exe	34
PID 272 wrote to memory of 1536	272	wscript.exe	34

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\Spare Parts Request MV Accord 8.13.20_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Spare Parts Request MV Accord 8.13.20_pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Spare Parts Request MV Accord 8.13.20_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Spare Parts Request MV Accord 8.13.20_pdf.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1604
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:532
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:792
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:272
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Spare Parts Request MV Accord 8.13.20_pdf.exe"
    3⤵
    - Deletes itself
    PID:1108
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-3-0x0000000000A20000-0x0000000000A46000-memory.dmp

Download

memory/272-5-0x0000000003220000-0x0000000003317000-memory.dmp

Download

memory/272-6-0x00000000750B0000-0x00000000750BC000-memory.dmp

Download

memory/272-7-0x0000000074BB0000-0x0000000074CCD000-memory.dmp

Download

memory/272-9-0x00000000041D0000-0x00000000042E0000-memory.dmp

Download

memory/1536-11-0x000000013F900000-0x000000013F993000-memory.dmp

Download

memory/1588-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1636-8-0x000007FEF7830000-0x000007FEF7AAA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads