formbook | 8a5ae789ab7a7fe7d2d2bd23a633ae2d4a06b8b3dd93d7ea716847209067a92d

Analysis

max time kernel
147s
max time network
173s
platform
windows7_x64
resource
win7
submitted
19/08/2020, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation Laminate - GIH.exe
Size 488KB
Sample200819-mayvmgh33j
SHA256 8a5ae789ab7a7fe7d2d2bd23a633ae2d4a06b8b3dd93d7ea716847209067a92d
MD5 d8a13606c45b5b585402f009044a8677
SHA1 fcb23cf174509fa4e72be49eb7f47a85994014f5
SHA512 4835a98ace51207606b7a94883a89809295b36ba621a07f29e171624ba142b8d8143598e401718050ff06bf57451b200076e062152abcdb514bf40b8d1d8a8da
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

http://www.joomlas123.com/mzg/

Decoy

fit2patient.com
raigadvp.com
hayazen.com
thefirstaidproject.com
zhijiewen.com
xiaobai918.com
mediatech.store
msi-afg.net
melanieblassphotography.com
1024fffb.info
korgpatches.com
cityophonepbw.com
pinkandbluedesignstudio.com
art-brokers.com
banditpets.com
webxyx.com
shayuquan.com
hfbycy.com
mkoz7p.info
gdtopsail.com
activismxuz.science
solderisland.com
sotolog.life
j-status.com
hvn-tool.com
instaladoraresultado.com
ryanrawitscher.com
domainsincome.com
barefootvigor.com
cratehunt.com
sportpark-taufkirchen.com
masterclasses-cooking.com
uygur.tech
dieschoenschreiberin.net
xn--rhq8gk6clzo.com
zhushankaoyan.com
in-dire.com
slckstck.com
tekbootik.com
interblocku.agency
smsvarsha.com
internetmarketingvids.com
vierahandy.com
millypr.com
bcstrategist.info
cientotreintagrados.com
kevinwardracing.com
uneed2parts.com
qa-jfs-sitelock-test-170908.com
diamondhairroom.com
tamilbb.com
elegantdent.com
imessemi.com
officialjertopsale.com
cryptoworld.academy
rugbeeground.com
scrapplus.net
kateakulenko.com
xqt51888.com
pcymailer8.com
businessdevfun.com
szgypj.com
whamsupersnack.com
i-brokers.insure

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1616-4-0x000000000041ED30-mapping.dmp	formbook
behavioral1/memory/1616-3-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1616-3-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1708-11-0x0000000000000000-mapping.dmp	formbook

Loads dropped DLL 1 IoCs

pid	Process
1512	Quotation Laminate - GIH.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1512 set thread context of 1616	1512	Quotation Laminate - GIH.exe	24
PID 1616 set thread context of 1312	1616	Quotation Laminate - GIH.exe	20
PID 1708 set thread context of 1312	1708	cmmon32.exe	20

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmmon32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1512	Quotation Laminate - GIH.exe
1616	Quotation Laminate - GIH.exe
1616	Quotation Laminate - GIH.exe
1512	Quotation Laminate - GIH.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1616	Quotation Laminate - GIH.exe
1616	Quotation Laminate - GIH.exe
1616	Quotation Laminate - GIH.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe
1708	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	Quotation Laminate - GIH.exe
Token: SeDebugPrivilege	1616	Quotation Laminate - GIH.exe
Token: SeDebugPrivilege	1708	cmmon32.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1616	1512	Quotation Laminate - GIH.exe	24
PID 1512 wrote to memory of 1616	1512	Quotation Laminate - GIH.exe	24
PID 1512 wrote to memory of 1616	1512	Quotation Laminate - GIH.exe	24
PID 1512 wrote to memory of 1616	1512	Quotation Laminate - GIH.exe	24
PID 1512 wrote to memory of 1616	1512	Quotation Laminate - GIH.exe	24
PID 1512 wrote to memory of 1616	1512	Quotation Laminate - GIH.exe	24
PID 1512 wrote to memory of 1616	1512	Quotation Laminate - GIH.exe	24
PID 1512 wrote to memory of 756	1512	Quotation Laminate - GIH.exe	25
PID 1512 wrote to memory of 756	1512	Quotation Laminate - GIH.exe	25
PID 1512 wrote to memory of 756	1512	Quotation Laminate - GIH.exe	25
PID 1512 wrote to memory of 756	1512	Quotation Laminate - GIH.exe	25
PID 1512 wrote to memory of 1108	1512	Quotation Laminate - GIH.exe	27
PID 1512 wrote to memory of 1108	1512	Quotation Laminate - GIH.exe	27
PID 1512 wrote to memory of 1108	1512	Quotation Laminate - GIH.exe	27
PID 1512 wrote to memory of 1108	1512	Quotation Laminate - GIH.exe	27
PID 1108 wrote to memory of 1500	1108	cmd.exe	29
PID 1108 wrote to memory of 1500	1108	cmd.exe	29
PID 1108 wrote to memory of 1500	1108	cmd.exe	29
PID 1108 wrote to memory of 1500	1108	cmd.exe	29
PID 1312 wrote to memory of 1708	1312	Explorer.EXE	30
PID 1312 wrote to memory of 1708	1312	Explorer.EXE	30
PID 1312 wrote to memory of 1708	1312	Explorer.EXE	30
PID 1312 wrote to memory of 1708	1312	Explorer.EXE	30
PID 1512 wrote to memory of 1816	1512	Quotation Laminate - GIH.exe	31
PID 1512 wrote to memory of 1816	1512	Quotation Laminate - GIH.exe	31
PID 1512 wrote to memory of 1816	1512	Quotation Laminate - GIH.exe	31
PID 1512 wrote to memory of 1816	1512	Quotation Laminate - GIH.exe	31
PID 1708 wrote to memory of 1932	1708	cmmon32.exe	34
PID 1708 wrote to memory of 1932	1708	cmmon32.exe	34
PID 1708 wrote to memory of 1932	1708	cmmon32.exe	34
PID 1708 wrote to memory of 1932	1708	cmmon32.exe	34
PID 1708 wrote to memory of 1932	1708	cmmon32.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\Quotation Laminate - GIH.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation Laminate - GIH.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Quotation Laminate - GIH.exe
    "C:/Users/Admin/AppData/Local/Temp/Quotation Laminate - GIH.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Quotation Laminate - GIH.exe" "%temp%\FolderN\name.exe" /Y
    3⤵
    PID:756
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
      4⤵
      PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
    3⤵
    - NTFS ADS
    PID:1816
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-0-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Download

memory/1512-1-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/1616-3-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1708-15-0x0000000003A90000-0x0000000003B70000-memory.dmp

Download

memory/1708-14-0x0000000003060000-0x000000000310B000-memory.dmp

Download

memory/1708-12-0x0000000000190000-0x000000000019D000-memory.dmp

Download

memory/1876-13-0x000007FEF7C00000-0x000007FEF7E7A000-memory.dmp

Download

memory/1932-17-0x000000013F4D0000-0x000000013F563000-memory.dmp

Download