formbook | f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c

General

Target
k7j7Sua3JrEZNPR.exe
Size 630KB
Sample201009-r83jsv41ke
SHA256 f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c
MD5 80338c0fd0b356384c5c238cd0167aa6
SHA1 be0ccb384d79527d6861dc4999e8bea2197a368d
SHA512 c5bd9e0d2a00fc59e7db5a753a67bd029374561080fc8b587ef284da03a5cf4f8090ffe0f43e2dda275841018833f6c3baf112dffa0cdbba6000fbba0e419029
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1844-4-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1844-5-0x000000000041EB90-mapping.dmp	formbook
behavioral1/memory/1940-7-0x0000000000000000-mapping.dmp	formbook

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 1844	1096	k7j7Sua3JrEZNPR.exe	30
PID 1844 set thread context of 1256	1844	k7j7Sua3JrEZNPR.exe	20
PID 1844 set thread context of 1256	1844	k7j7Sua3JrEZNPR.exe	20
PID 1940 set thread context of 1256	1940	systray.exe	20

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1620	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	systray.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Suspicious behavior: MapViewOfSection 8 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1620	1096	k7j7Sua3JrEZNPR.exe	28
PID 1096 wrote to memory of 1620	1096	k7j7Sua3JrEZNPR.exe	28
PID 1096 wrote to memory of 1620	1096	k7j7Sua3JrEZNPR.exe	28
PID 1096 wrote to memory of 1620	1096	k7j7Sua3JrEZNPR.exe	28
PID 1096 wrote to memory of 1844	1096	k7j7Sua3JrEZNPR.exe	30
PID 1096 wrote to memory of 1844	1096	k7j7Sua3JrEZNPR.exe	30
PID 1096 wrote to memory of 1844	1096	k7j7Sua3JrEZNPR.exe	30
PID 1096 wrote to memory of 1844	1096	k7j7Sua3JrEZNPR.exe	30
PID 1096 wrote to memory of 1844	1096	k7j7Sua3JrEZNPR.exe	30
PID 1096 wrote to memory of 1844	1096	k7j7Sua3JrEZNPR.exe	30
PID 1096 wrote to memory of 1844	1096	k7j7Sua3JrEZNPR.exe	30
PID 1256 wrote to memory of 1940	1256	Explorer.EXE	31
PID 1256 wrote to memory of 1940	1256	Explorer.EXE	31
PID 1256 wrote to memory of 1940	1256	Explorer.EXE	31
PID 1256 wrote to memory of 1940	1256	Explorer.EXE	31
PID 1940 wrote to memory of 320	1940	systray.exe	33
PID 1940 wrote to memory of 320	1940	systray.exe	33
PID 1940 wrote to memory of 320	1940	systray.exe	33
PID 1940 wrote to memory of 320	1940	systray.exe	33
PID 1940 wrote to memory of 320	1940	systray.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\k7j7Sua3JrEZNPR.exe
  "C:\Users\Admin\AppData\Local\Temp\k7j7Sua3JrEZNPR.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qROGyQuA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF7F6.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\k7j7Sua3JrEZNPR.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:320