formbook | e2ff7c5e749d36ebfcc2a9d5af487369e454ef301a859eb8fc11ebe15ea73e34

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10
submitted
18/08/2020, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remittance copy.exe
Size 1021KB
Sample200818-73yt4ml86x
SHA256 e2ff7c5e749d36ebfcc2a9d5af487369e454ef301a859eb8fc11ebe15ea73e34
MD5 d9122108ec3cd7a570190d6add288526
SHA1 c3bb30592f68bb0071b72828ee1480ed673cbb85
SHA512 00a5ba7002c4231254ecc7a669b9e453430c3101937896a25cb4c341da123d1fd23b0e4b8094d003520a61b35ea9a92ffa30a4f898eb3457c2faf43a4dcf859f
MD5 SHA1 SHA512

Score

10^/10

rat persistence spyware trojan stealer formbook

Malware Config

Extracted

Family

formbook

http://www.iskovlay.com/mcn/

Decoy

qww13.com
polyadmission.com
blackbaycooler.com
angelmedics.net
saludcomplementariaintegral.com
multonin.reisen
atelier-des-lilas.com
theflamingorealtygroup.info
minnesotaauto.loan
silvfly.com
ubaoc.com
learcane.net
giftcardcodegenerator.com
consciousnessunpleasant.com
g1media.net
wwwstrikeout.com
yimifanghua.com
stampkm.com
bx-wdcl.com
unieekly.net
endsellerfraud.com
kriptoanaliz.com
deepcallsmusic.com
antiterrorsecurity.technology
wesk.tech
xbjxs.com
jnjmqzzl.com
1-edogawa-one.net
hnpzgc.com
vieclam-jobs.net
intensivprogramme.com
jlegitimus.com
f0aw9u.com
strikermillion.net
skyhomeshn.com
thatmountainbiking.com
sanweigame.com
rilke.photography
jp-accntapps02102911verif.com
radiomaceiomix.com
theshopby.com
surveywithease.com
cexo.ltd
frontgames.info
ukdealpal.com
fizzwagon.com
beautyfullyboundless.com
myadaptivespace.com
gentlemanism.com
longdu665.com
mlabsassociates.com
adventurechanneltv.com
j9d9.com
ehoulby.com
schisox.win
serviceiqinternational.com
smokinginc.com
mariscando.com
larympei.com
zhguixin.site
yuomi.net
butiku01.com
recetasinstantpot.com
designing-home.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3904-8-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral2/memory/3904-8-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral2/memory/3904-9-0x000000000041E310-mapping.dmp	formbook
behavioral2/memory/3952-10-0x0000000000000000-mapping.dmp	formbook

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ULCDER506L3 = "C:\\Program Files (x86)\\Qznr8\\ms3f9l_rfp.exe"	wscript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1536 set thread context of 3904	1536	Remittance copy.exe	69
PID 3904 set thread context of 3028	3904	RegAsm.exe	56
PID 3952 set thread context of 3028	3952	wscript.exe	56

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Qznr8\ms3f9l_rfp.exe	wscript.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wscript.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3904	RegAsm.exe
3904	RegAsm.exe
3904	RegAsm.exe
3904	RegAsm.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
1536	Remittance copy.exe
1536	Remittance copy.exe
1536	Remittance copy.exe
3904	RegAsm.exe
3904	RegAsm.exe
3904	RegAsm.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe
3952	wscript.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	RegAsm.exe
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE
Token: SeDebugPrivilege	3952	wscript.exe
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	Explorer.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3028	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3840	1536	Remittance copy.exe	67
PID 1536 wrote to memory of 3840	1536	Remittance copy.exe	67
PID 1536 wrote to memory of 3840	1536	Remittance copy.exe	67
PID 1536 wrote to memory of 3640	1536	Remittance copy.exe	68
PID 1536 wrote to memory of 3640	1536	Remittance copy.exe	68
PID 1536 wrote to memory of 3640	1536	Remittance copy.exe	68
PID 1536 wrote to memory of 3904	1536	Remittance copy.exe	69
PID 1536 wrote to memory of 3904	1536	Remittance copy.exe	69
PID 1536 wrote to memory of 3904	1536	Remittance copy.exe	69
PID 1536 wrote to memory of 3904	1536	Remittance copy.exe	69
PID 3028 wrote to memory of 3952	3028	Explorer.EXE	70
PID 3028 wrote to memory of 3952	3028	Explorer.EXE	70
PID 3028 wrote to memory of 3952	3028	Explorer.EXE	70
PID 3952 wrote to memory of 2936	3952	wscript.exe	71
PID 3952 wrote to memory of 2936	3952	wscript.exe	71
PID 3952 wrote to memory of 2936	3952	wscript.exe	71
PID 3952 wrote to memory of 3020	3952	wscript.exe	75
PID 3952 wrote to memory of 3020	3952	wscript.exe	75
PID 3952 wrote to memory of 3020	3952	wscript.exe	75
PID 3952 wrote to memory of 2328	3952	wscript.exe	78
PID 3952 wrote to memory of 2328	3952	wscript.exe	78
PID 3952 wrote to memory of 2328	3952	wscript.exe	78

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\Remittance copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Remittance copy.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3952
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:3020
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-6-0x0000000006670000-0x000000000669D000-memory.dmp

Download

memory/1536-4-0x0000000005610000-0x0000000005644000-memory.dmp

Download

memory/1536-3-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Download

memory/1536-0-0x0000000073410000-0x0000000073AFE000-memory.dmp

Download

memory/1536-1-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/2328-19-0x00007FF706F90000-0x00007FF707023000-memory.dmp

Download

memory/2328-21-0x00007FF706F90000-0x00007FF707023000-memory.dmp

Download

memory/2328-20-0x00007FF706F90000-0x00007FF707023000-memory.dmp

Download

memory/3904-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3952-17-0x00000000066B0000-0x000000000677B000-memory.dmp

Download

memory/3952-14-0x0000000004570000-0x00000000046D3000-memory.dmp

Download

memory/3952-12-0x0000000000930000-0x0000000000957000-memory.dmp

Download

memory/3952-11-0x0000000000930000-0x0000000000957000-memory.dmp

Download