formbook | 9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8

Analysis

max time kernel
147s
max time network
136s
platform
windows10_x64
resource
win10v200722
submitted
17/08/2020, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
000021.exe
Size 1.1MB
Sample200817-bysx6v7gsj
SHA256 9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
MD5 e1982141c06e7fab8f93001329630edb
SHA1 de17d013de18a44c118dedc9927fef6503186efb
SHA512 cfdbe4986a62a74a32c1d7ff023f9ef75b7f46c4cafed40a4f9adddb2b9d44b6ded1e5369119d5dde4423d0ea43e789362cb178240b23b2cd463982b689daaa2
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook persistence

Malware Config

Extracted

Family

formbook

http://www.flekcht.com/blo/

Decoy

social-shoping.net
cavallimusica.cloud
mountainscapema.com
murashi.net
christianseichrist.com
myzmahkhan.com
bellesmeals.com
kadirertas.net
shilpcart.com
manx055.com
majorsweepssoft.com
mesaudakorea.com
elcaminourgentcare.com
nsrisksolutions.co.uk
yourcellphoneoffice.com
abscessed-tooth.info
paisajesenmiretina.com
lleidablockchain.com
overseastickets.com
herbenproducts.com
cjexrv.info
opebet914.com
bigcreekski.net
recipe-face-off.com
barefootfit.com
alwaysdryshop.com
favoritetraffic4updates.review
shoeswordpress.com
picturebuttealbertahomes.info
chungcut3thanglongcapital.com
perfectclass.info
estuaryastoria.com
dejahale.com
eastgold.info
elsevieripevideogallery.com
xn--mtsu59behdk9c.com
guialobos.com
americacctvsecurity.com
harlandlundy.com
qicai6688.com
constats95.com
thehabitatconsortium.com
dpqth.info
swiss-teams.com
sclprohealthboost.com
mygames2018.com
tierralagos.com
chrisklos.com
lloydsus.com
zimahvac.com
tn444.com
misitio.solutions
floydcountygop.com
xn--939a69sn9b4uu5li.com
jogalocutor.com
mypethk.com
elaineoneilllactation.com
mpracewear.com
knowledgesmile.com
sippemx.com
sunruise.com
land8551.com
btctribune.com
insidenorthcarolinagolf.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 8 IoCs

rat

resource	yara_rule
behavioral2/memory/1104-496-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral2/memory/1104-496-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral2/memory/1104-497-0x000000000041E340-mapping.dmp	formbook
behavioral2/memory/1272-500-0x0000000000400000-0x00000000009EEA9B-memory.dmp	formbook
behavioral2/memory/1272-500-0x0000000000400000-0x00000000009EEA9B-memory.dmp	formbook
behavioral2/memory/1272-502-0x000000000041E340-mapping.dmp	formbook
behavioral2/memory/1196-506-0x0000000000000000-mapping.dmp	formbook
behavioral2/memory/1640-507-0x0000000000000000-mapping.dmp	formbook

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	systray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\9RU8FTBPPNM = "C:\\Program Files (x86)\\Qt8t0\\user1bm0gnmx.exe"	systray.exe

Executes dropped EXE 3 IoCs

pid	Process
988	ptftgx.pif
1104	RegSvcs.exe
1272	RegSvcs.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 1104	988	ptftgx.pif	82
PID 988 set thread context of 1272	988	ptftgx.pif	81
PID 1104 set thread context of 3004	1104	RegSvcs.exe	56
PID 1272 set thread context of 3004	1272	RegSvcs.exe	56
PID 1196 set thread context of 3004	1196	systray.exe	56

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Qt8t0\user1bm0gnmx.exe	systray.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	systray.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
988	ptftgx.pif
1104	RegSvcs.exe
1104	RegSvcs.exe
1272	RegSvcs.exe
1272	RegSvcs.exe
1104	RegSvcs.exe
1104	RegSvcs.exe
1272	RegSvcs.exe
1272	RegSvcs.exe
1196	systray.exe
1196	systray.exe
1640	rundll32.exe
1640	rundll32.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
1104	RegSvcs.exe
1272	RegSvcs.exe
1104	RegSvcs.exe
1272	RegSvcs.exe
1104	RegSvcs.exe
1272	RegSvcs.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe
1196	systray.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	RegSvcs.exe
Token: SeDebugPrivilege	1272	RegSvcs.exe
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeDebugPrivilege	1196	systray.exe
Token: SeDebugPrivilege	1640	rundll32.exe
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
988	ptftgx.pif

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 988	4036	000021.exe	66
PID 4036 wrote to memory of 988	4036	000021.exe	66
PID 4036 wrote to memory of 988	4036	000021.exe	66
PID 988 wrote to memory of 3100	988	ptftgx.pif	74
PID 988 wrote to memory of 3100	988	ptftgx.pif	74
PID 988 wrote to memory of 3100	988	ptftgx.pif	74
PID 988 wrote to memory of 3748	988	ptftgx.pif	75
PID 988 wrote to memory of 3748	988	ptftgx.pif	75
PID 988 wrote to memory of 3748	988	ptftgx.pif	75
PID 988 wrote to memory of 3544	988	ptftgx.pif	76
PID 988 wrote to memory of 3544	988	ptftgx.pif	76
PID 988 wrote to memory of 3544	988	ptftgx.pif	76
PID 988 wrote to memory of 3604	988	ptftgx.pif	77
PID 988 wrote to memory of 3604	988	ptftgx.pif	77
PID 988 wrote to memory of 3604	988	ptftgx.pif	77
PID 988 wrote to memory of 1856	988	ptftgx.pif	78
PID 988 wrote to memory of 1856	988	ptftgx.pif	78
PID 988 wrote to memory of 1856	988	ptftgx.pif	78
PID 988 wrote to memory of 3276	988	ptftgx.pif	79
PID 988 wrote to memory of 3276	988	ptftgx.pif	79
PID 988 wrote to memory of 3276	988	ptftgx.pif	79
PID 988 wrote to memory of 504	988	ptftgx.pif	80
PID 988 wrote to memory of 504	988	ptftgx.pif	80
PID 988 wrote to memory of 504	988	ptftgx.pif	80
PID 988 wrote to memory of 1272	988	ptftgx.pif	81
PID 988 wrote to memory of 1272	988	ptftgx.pif	81
PID 988 wrote to memory of 1272	988	ptftgx.pif	81
PID 988 wrote to memory of 1104	988	ptftgx.pif	82
PID 988 wrote to memory of 1104	988	ptftgx.pif	82
PID 988 wrote to memory of 1104	988	ptftgx.pif	82
PID 988 wrote to memory of 1104	988	ptftgx.pif	82
PID 988 wrote to memory of 1104	988	ptftgx.pif	82
PID 988 wrote to memory of 1104	988	ptftgx.pif	82
PID 988 wrote to memory of 1272	988	ptftgx.pif	81
PID 988 wrote to memory of 1272	988	ptftgx.pif	81
PID 3004 wrote to memory of 1640	3004	Explorer.EXE	83
PID 3004 wrote to memory of 1640	3004	Explorer.EXE	83
PID 3004 wrote to memory of 1640	3004	Explorer.EXE	83
PID 3004 wrote to memory of 1196	3004	Explorer.EXE	84
PID 3004 wrote to memory of 1196	3004	Explorer.EXE	84
PID 3004 wrote to memory of 1196	3004	Explorer.EXE	84
PID 1196 wrote to memory of 3596	1196	systray.exe	85
PID 1196 wrote to memory of 3596	1196	systray.exe	85
PID 1196 wrote to memory of 3596	1196	systray.exe	85
PID 1196 wrote to memory of 2324	1196	systray.exe	87
PID 1196 wrote to memory of 2324	1196	systray.exe	87
PID 1196 wrote to memory of 2324	1196	systray.exe	87
PID 1196 wrote to memory of 3592	1196	systray.exe	89
PID 1196 wrote to memory of 3592	1196	systray.exe	89
PID 1196 wrote to memory of 3592	1196	systray.exe	89

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\000021.exe
  "C:\Users\Admin\AppData\Local\Temp\000021.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Users\Admin\AppData\Roaming\81943283\ptftgx.pif
    "C:\Users\Admin\AppData\Roaming\81943283\ptftgx.pif" wguea.hig
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:3100
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:3748
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:3544
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:3604
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:3276
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:504
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    PID:3596
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:2324
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-4-0x0000000072C00000-0x0000000072C93000-memory.dmp

Download

memory/1104-501-0x0000000072C00000-0x0000000072C93000-memory.dmp

Download

memory/1104-496-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1196-508-0x0000000001030000-0x0000000001036000-memory.dmp

Download

memory/1196-513-0x0000000005B50000-0x0000000005BF8000-memory.dmp

Download

memory/1196-510-0x0000000001030000-0x0000000001036000-memory.dmp

Download

memory/1272-504-0x0000000072C00000-0x0000000072C93000-memory.dmp

Download

memory/1272-500-0x0000000000400000-0x00000000009EEA9B-memory.dmp

Download

memory/1640-509-0x0000000001220000-0x0000000001233000-memory.dmp

Download

memory/1640-512-0x0000000001220000-0x0000000001233000-memory.dmp

Download

memory/3592-520-0x00007FF6C0AE0000-0x00007FF6C0B73000-memory.dmp

Download

memory/3592-521-0x00007FF6C0AE0000-0x00007FF6C0B73000-memory.dmp

Download

memory/3592-522-0x00007FF6C0AE0000-0x00007FF6C0B73000-memory.dmp

Download