formbook | b65aa99b0824e448e16e18d72469f80fdf29d0febdb289d7723f0f96b31c4ad4

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7
submitted
17/08/2020, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
new Order.exe
Size 414KB
Sample200817-dlc8m1ftnn
SHA256 b65aa99b0824e448e16e18d72469f80fdf29d0febdb289d7723f0f96b31c4ad4
MD5 97b9370df3ff0950225edb7992e136b8
SHA1 f1cc5e345db067b492aaf550e8d5fde539c05d59
SHA512 13d1ab6e3e339db9e4e44d626685fe70dcde1eff6eef8ce84911dbc5e5f3c2263ac45509dd6c434273206bfd0c1950105964dda10e75331d81e0bcb32450ce0e
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook persistence

Malware Config

Extracted

Family

formbook

http://www.regulars6.info/rs26/

Decoy

amazon-review.info
17kaihuiba.com
timeableholdings.com
techvestorsmultifamily.com
rokketsoftware.com
abbigliamentoagricolo.com
artjiayi.com
smooouse.com
lightcastwired.com
bravuad.com
mr133.com
clubfitdartmouth.com
masturbation-stories.net
yedekparcatreni.com
pureologyrising.com
goodsystem2updating.download
fn4pk8p0o5.com
climatechangersofny.com
shuangxian023.com
lxiuot.men
nhchangxing.com
gekaartliving.com
cqowru.info
calmbomb.science
eegg.ltd
lombokraratour.com
justwatchmovie.info
inclusivelisteningeffect.com
likyapix.com
zojike59.win
wiechmannequity.com
stoptherapycaps.net
cowleyroadmotcentre.com
ruiba360.com
colr.net
odiariodeumamissionaria.com
realizecollective.com
bestcasasparticulares.com
xue2u.com
carolinachildrensmuseum.com
vaborbactam.healthcare
ladygaga.cloud
countfbfda.tech
stieble.com
yyu9fy.com
rusticrootzboutique.com
whyisaaroncaldwellsodamnhot.com
begentlewellness.net
hellobrazen.com
recapped.net
rogerandchristinestravels.com
penjiazi.com
alexandratracey.com
sofianoorani.com
anti-terrorsecurity.today
translationsinberlin.com
bestfriendwhisky.com
ukabhotels.info
grupoacye.com
casmio.com
ctbct.info
gzexchange.com
anewfinances.com
footballsocceragent.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1676-8-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1676-8-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1676-9-0x000000000041E390-mapping.dmp	formbook
behavioral1/memory/1768-11-0x0000000000000000-mapping.dmp	formbook

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ipconfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KV1HBN_H16 = "C:\\Program Files (x86)\\Lbdm\\chkdskopx0.exe"	ipconfig.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1676	1464	new Order.exe	26
PID 1676 set thread context of 1228	1676	RegSvcs.exe	20
PID 1676 set thread context of 1228	1676	RegSvcs.exe	20
PID 1768 set thread context of 1228	1768	ipconfig.exe	20

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Lbdm\chkdskopx0.exe	ipconfig.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1028	schtasks.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1768	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1464	new Order.exe
1464	new Order.exe
1464	new Order.exe
1676	RegSvcs.exe
1676	RegSvcs.exe
1676	RegSvcs.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1676	RegSvcs.exe
1676	RegSvcs.exe
1676	RegSvcs.exe
1676	RegSvcs.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe
1768	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	new Order.exe
Token: SeDebugPrivilege	1676	RegSvcs.exe
Token: SeDebugPrivilege	1768	ipconfig.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1028	1464	new Order.exe	24
PID 1464 wrote to memory of 1028	1464	new Order.exe	24
PID 1464 wrote to memory of 1028	1464	new Order.exe	24
PID 1464 wrote to memory of 1028	1464	new Order.exe	24
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1464 wrote to memory of 1676	1464	new Order.exe	26
PID 1228 wrote to memory of 1768	1228	Explorer.EXE	27
PID 1228 wrote to memory of 1768	1228	Explorer.EXE	27
PID 1228 wrote to memory of 1768	1228	Explorer.EXE	27
PID 1228 wrote to memory of 1768	1228	Explorer.EXE	27
PID 1768 wrote to memory of 1892	1768	ipconfig.exe	28
PID 1768 wrote to memory of 1892	1768	ipconfig.exe	28
PID 1768 wrote to memory of 1892	1768	ipconfig.exe	28
PID 1768 wrote to memory of 1892	1768	ipconfig.exe	28
PID 1768 wrote to memory of 1332	1768	ipconfig.exe	33
PID 1768 wrote to memory of 1332	1768	ipconfig.exe	33
PID 1768 wrote to memory of 1332	1768	ipconfig.exe	33
PID 1768 wrote to memory of 1332	1768	ipconfig.exe	33
PID 1768 wrote to memory of 1332	1768	ipconfig.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\new Order.exe
  "C:\Users\Admin\AppData\Local\Temp\new Order.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ljznASZxgBd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAE57.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1028
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Gathers network information
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1892
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-10-0x0000000006A80000-0x0000000006BD9000-memory.dmp

Download

memory/1332-20-0x000000013F4E0000-0x000000013F573000-memory.dmp

Download

memory/1464-1-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/1464-4-0x0000000004930000-0x000000000497D000-memory.dmp

Download

memory/1464-5-0x00000000008A0000-0x00000000008CE000-memory.dmp

Download

memory/1464-3-0x00000000002B0000-0x00000000002B4000-memory.dmp

Download

memory/1464-0-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Download

memory/1676-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1768-15-0x0000000076880000-0x000000007688C000-memory.dmp

Download

memory/1768-18-0x0000000003B80000-0x0000000003D06000-memory.dmp

Download

memory/1768-16-0x0000000076EC0000-0x0000000076FDD000-memory.dmp

Download

memory/1768-14-0x0000000002F90000-0x000000000309F000-memory.dmp

Download

memory/1768-12-0x0000000000560000-0x000000000056A000-memory.dmp

Download

memory/2020-17-0x000007FEF7E20000-0x000007FEF809A000-memory.dmp

Download