formbook | 2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3

General

Target
orden de compra.exe
Size 380KB
Sample200814-sbeft2w49s
SHA256 2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3
MD5 2a30abd4d6db32bfc49a069c56ceb45c
SHA1 dc1411169ccfac189b4370ce8342779051a65753
SHA512 fa5110812d55c02e597b4ec890b6f40bcb23e66ecb79189f4d0e461cb87c40f4fb3a36cf6f3edf47b9c4ab9b784702751338399a5cfe14e9bd31ba3b8917403f
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.fex-tracks.com/kvsz/

Decoy

okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/288-8-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/288-8-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/288-9-0x000000000041ECA0-mapping.dmp	formbook
behavioral1/memory/1084-11-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 288	1124	orden de compra.exe	26
PID 288 set thread context of 1304	288	RegSvcs.exe	20
PID 288 set thread context of 1304	288	RegSvcs.exe	20
PID 1084 set thread context of 1304	1084	cscript.exe	20

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1124	orden de compra.exe
1124	orden de compra.exe
1124	orden de compra.exe
288	RegSvcs.exe
288	RegSvcs.exe
288	RegSvcs.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe
1084	cscript.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
288	RegSvcs.exe
288	RegSvcs.exe
288	RegSvcs.exe
288	RegSvcs.exe
1084	cscript.exe
1084	cscript.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	orden de compra.exe
Token: SeDebugPrivilege	288	RegSvcs.exe
Token: SeShutdownPrivilege	1304	Explorer.EXE
Token: SeDebugPrivilege	1084	cscript.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1620	1124	orden de compra.exe	24
PID 1124 wrote to memory of 1620	1124	orden de compra.exe	24
PID 1124 wrote to memory of 1620	1124	orden de compra.exe	24
PID 1124 wrote to memory of 1620	1124	orden de compra.exe	24
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1124 wrote to memory of 288	1124	orden de compra.exe	26
PID 1304 wrote to memory of 1084	1304	Explorer.EXE	27
PID 1304 wrote to memory of 1084	1304	Explorer.EXE	27
PID 1304 wrote to memory of 1084	1304	Explorer.EXE	27
PID 1304 wrote to memory of 1084	1304	Explorer.EXE	27
PID 1084 wrote to memory of 1516	1084	cscript.exe	28
PID 1084 wrote to memory of 1516	1084	cscript.exe	28
PID 1084 wrote to memory of 1516	1084	cscript.exe	28
PID 1084 wrote to memory of 1516	1084	cscript.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\orden de compra.exe
  "C:\Users\Admin\AppData\Local\Temp\orden de compra.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\soPSGUbyne" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA6F8.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1620
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:288
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-8-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1084-14-0x00000000033D0000-0x0000000003551000-memory.dmp

Download

memory/1084-12-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/1124-4-0x0000000004AC0000-0x0000000004B10000-memory.dmp

Download

memory/1124-5-0x0000000004620000-0x000000000464F000-memory.dmp

Download

memory/1124-0-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Download

memory/1124-3-0x00000000004F0000-0x00000000004F4000-memory.dmp

Download

memory/1124-1-0x0000000000010000-0x0000000000011000-memory.dmp

Download

memory/1304-10-0x0000000006A50000-0x0000000006BA6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads