formbook | 22722e6e6da1ce062caad041e121b74af35678e455cfc0de59c3ea1eeb469520

Analysis

max time kernel
149s
max time network
153s
platform
windows10_x64
resource
win10
submitted
17/08/2020, 08:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Confirmation Receipt.exe
Size 526KB
Sample200817-ca2qtrsl16
SHA256 22722e6e6da1ce062caad041e121b74af35678e455cfc0de59c3ea1eeb469520
MD5 a21e01bef23ec4f2f0ad9d2e284d5985
SHA1 0fa02ff978cc75540c0ee2dca006e4a66ce9d5c3
SHA512 4f4e4fe7a13107a17ea8228b609cfc1f3e20cce308db485fcdb891bbde1c37e158a0d9f6ac8f3a0ccf2bbf1eeceeeac5903dab18944bfc5677f3c354586ba3af
MD5 SHA1 SHA512

Score

10^/10

rat spyware trojan stealer formbook persistence

Malware Config

Extracted

Family

formbook

http://www.mansiobok2.info/2cte/

Decoy

worksafecambodia.com
urbegal.com
topics21.net
gh1ag.info
majesticbuddha.com
aixnio.com
yunnanqiaoyi.com
aiforfuture.com
091man.com
2b47.com
rlj5qb0v.site
fr6226.com
idriveuk.co.uk
093opebet.com
123cargames.com
zhejiangft.com
x16110.com
snared.biz
mbeintl.com
bonjourxandra.com
mazbah.com
wastateleasedportfolio.com
calgarywraptors.com
seminarpaprika.win
kimlongseason.com
671bifa.com
privateyogateachers.com
coldcannaenergy.com
carllikes.com
creditreportsite.link
outsourcechief.com
fixerapps.com
myb0.com
hayalimdekiyaz.com
ourcooppower.com
green-signals.com
upivc.info
balancoop2.com
securemail-bioprocure.com
coderedtacoma.net
kursustahsin.com
kxg68.com
thechuffedfox.com
askdatadriven.com
jiyukim.com
safetrafficupgrading.review
goldensoilny.net
whczf.net
seatpath.com
jcobet.net
familytherapisteugene.com
ottomanssaat.com
oronews.com
matome.wiki
un542.com
kaisei-g.com
funfascinators.com
skarbyzpodhala.com
qyqlgs.com
medicalspanishtranslator.com
taoke520.com
qqgan83.com
bizcochodominicanoclases.com
grdgt.rocks

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1184-13-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral2/memory/1184-13-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral2/memory/1184-14-0x000000000041E2A0-mapping.dmp	formbook
behavioral2/memory/1360-16-0x0000000000000000-mapping.dmp	formbook

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	raserver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\I8TP2PXX = "C:\\Program Files (x86)\\Nl0x\\npltor5g2kdsb.exe"	raserver.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 1184	3908	Payment Confirmation Receipt.exe	76
PID 1184 set thread context of 2964	1184	Payment Confirmation Receipt.exe	56
PID 1360 set thread context of 2964	1360	raserver.exe	56

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Nl0x\npltor5g2kdsb.exe	raserver.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1008	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3908	Payment Confirmation Receipt.exe
3908	Payment Confirmation Receipt.exe
1184	Payment Confirmation Receipt.exe
1184	Payment Confirmation Receipt.exe
1184	Payment Confirmation Receipt.exe
1184	Payment Confirmation Receipt.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1184	Payment Confirmation Receipt.exe
1184	Payment Confirmation Receipt.exe
1184	Payment Confirmation Receipt.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe
1360	raserver.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	Payment Confirmation Receipt.exe
Token: SeDebugPrivilege	1184	Payment Confirmation Receipt.exe
Token: SeDebugPrivilege	1360	raserver.exe
Token: SeShutdownPrivilege	2964	Explorer.EXE
Token: SeCreatePagefilePrivilege	2964	Explorer.EXE
Token: SeShutdownPrivilege	2964	Explorer.EXE
Token: SeCreatePagefilePrivilege	2964	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 1008	3908	Payment Confirmation Receipt.exe	73
PID 3908 wrote to memory of 1008	3908	Payment Confirmation Receipt.exe	73
PID 3908 wrote to memory of 1008	3908	Payment Confirmation Receipt.exe	73
PID 3908 wrote to memory of 1176	3908	Payment Confirmation Receipt.exe	75
PID 3908 wrote to memory of 1176	3908	Payment Confirmation Receipt.exe	75
PID 3908 wrote to memory of 1176	3908	Payment Confirmation Receipt.exe	75
PID 3908 wrote to memory of 1184	3908	Payment Confirmation Receipt.exe	76
PID 3908 wrote to memory of 1184	3908	Payment Confirmation Receipt.exe	76
PID 3908 wrote to memory of 1184	3908	Payment Confirmation Receipt.exe	76
PID 3908 wrote to memory of 1184	3908	Payment Confirmation Receipt.exe	76
PID 3908 wrote to memory of 1184	3908	Payment Confirmation Receipt.exe	76
PID 3908 wrote to memory of 1184	3908	Payment Confirmation Receipt.exe	76
PID 2964 wrote to memory of 1360	2964	Explorer.EXE	77
PID 2964 wrote to memory of 1360	2964	Explorer.EXE	77
PID 2964 wrote to memory of 1360	2964	Explorer.EXE	77
PID 1360 wrote to memory of 1556	1360	raserver.exe	78
PID 1360 wrote to memory of 1556	1360	raserver.exe	78
PID 1360 wrote to memory of 1556	1360	raserver.exe	78
PID 1360 wrote to memory of 1976	1360	raserver.exe	80
PID 1360 wrote to memory of 1976	1360	raserver.exe	80
PID 1360 wrote to memory of 1976	1360	raserver.exe	80
PID 1360 wrote to memory of 2196	1360	raserver.exe	82
PID 1360 wrote to memory of 2196	1360	raserver.exe	82
PID 1360 wrote to memory of 2196	1360	raserver.exe	82

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Receipt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EDCNdPLX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp22EF.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Receipt.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Receipt.exe"
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Receipt.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Receipt.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Receipt.exe"
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:1976
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1360-23-0x0000000006320000-0x0000000006407000-memory.dmp

Download

memory/1360-18-0x00000000003A0000-0x00000000003BF000-memory.dmp

Download

memory/1360-17-0x00000000003A0000-0x00000000003BF000-memory.dmp

Download

memory/2196-25-0x00007FF6C8B00000-0x00007FF6C8B93000-memory.dmp

Download

memory/2196-27-0x00007FF6C8B00000-0x00007FF6C8B93000-memory.dmp

Download

memory/2196-26-0x00007FF6C8B00000-0x00007FF6C8B93000-memory.dmp

Download

memory/3908-7-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/3908-0-0x0000000073400000-0x0000000073AEE000-memory.dmp

Download

memory/3908-10-0x0000000006120000-0x000000000615E000-memory.dmp

Download

memory/3908-8-0x0000000005500000-0x0000000005503000-memory.dmp

Download

memory/3908-9-0x00000000060B0000-0x0000000006118000-memory.dmp

Download

memory/3908-6-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/3908-5-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/3908-4-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/3908-3-0x0000000005220000-0x0000000005221000-memory.dmp

Download

memory/3908-1-0x0000000000980000-0x0000000000981000-memory.dmp

Download