formbook | f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c

General

Target
k7j7Sua3JrEZNPR.exe
Size 630KB
Sample201009-r83jsv41ke
SHA256 f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c
MD5 80338c0fd0b356384c5c238cd0167aa6
SHA1 be0ccb384d79527d6861dc4999e8bea2197a368d
SHA512 c5bd9e0d2a00fc59e7db5a753a67bd029374561080fc8b587ef284da03a5cf4f8090ffe0f43e2dda275841018833f6c3baf112dffa0cdbba6000fbba0e419029
MD5 SHA1 SHA512

Score

10^/10

rat spyware trojan stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.trusted-inspections.com/k8b/

Decoy

lulubellsgraphicsanddesigns.com
metyx.info
www423337.com
stayliveclothing.com
daluotech.com
thetruthpublished.com
pqlzlnwpz.icu
bilginhayvancilik.com
ismartdvr.com
currenibtc.com
dalesj.com
restaurantlemontblanc.com
lunarstores.com
pho-huy.com
liquidhardrive.com
bcheaplivebuy.com
evisaagency.com
houstonemergencycenter.com
alioverstreet.com
nutrhyp.com
fzwsnrbzw.icu
shesoo.com
xn--meditaoevida-7bb9c.com
hayatveren-world.com
thegamergang.com
dayforum.com
teamhoodied.com
weightm-llc.com
synertry.net
mariaclarahairstudio.com
smartnomic.com
seaecstasy.com
bestourway.com
liferiskmanager.com
myeducationnoodle.com
cooklikeaspanish.com
apacheboatsstory.com
688009.xyz
even-hand.com
therussellpinto.com
browedandbare.com
hblajiche.com
bodygoalsspa.com
adeedyworld.com
daddydomsme.com
webioff.com
respec-d.com
bitches4studs.com
shorasmedan.com
mjzmusicphotography.com
govild.com
luckyfoodexpress.com
camouflagedbeauty.com
contaclessfundraising.com
sencmil.info
highwaistedskirts.com
alanppafcommodities.com
findingthefaceofgod.com
peiqizn.com
fallgays-mobile.com
goudengoed.com
shisang.xyz
akenco-pharma.com
fishingtournament.website

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2256-2-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2256-3-0x000000000041EB90-mapping.dmp	formbook
behavioral2/memory/2628-5-0x0000000000000000-mapping.dmp	formbook

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 408 set thread context of 2256	408	k7j7Sua3JrEZNPR.exe	78
PID 2256 set thread context of 3024	2256	k7j7Sua3JrEZNPR.exe	56
PID 2628 set thread context of 3024	2628	raserver.exe	56

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3752	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
408	k7j7Sua3JrEZNPR.exe
408	k7j7Sua3JrEZNPR.exe
408	k7j7Sua3JrEZNPR.exe
2256	k7j7Sua3JrEZNPR.exe
2256	k7j7Sua3JrEZNPR.exe
2256	k7j7Sua3JrEZNPR.exe
2256	k7j7Sua3JrEZNPR.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2256	k7j7Sua3JrEZNPR.exe
2256	k7j7Sua3JrEZNPR.exe
2256	k7j7Sua3JrEZNPR.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe
2628	raserver.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	408	k7j7Sua3JrEZNPR.exe
Token: SeDebugPrivilege	2256	k7j7Sua3JrEZNPR.exe
Token: SeDebugPrivilege	2628	raserver.exe
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3752	408	k7j7Sua3JrEZNPR.exe	76
PID 408 wrote to memory of 3752	408	k7j7Sua3JrEZNPR.exe	76
PID 408 wrote to memory of 3752	408	k7j7Sua3JrEZNPR.exe	76
PID 408 wrote to memory of 2256	408	k7j7Sua3JrEZNPR.exe	78
PID 408 wrote to memory of 2256	408	k7j7Sua3JrEZNPR.exe	78
PID 408 wrote to memory of 2256	408	k7j7Sua3JrEZNPR.exe	78
PID 408 wrote to memory of 2256	408	k7j7Sua3JrEZNPR.exe	78
PID 408 wrote to memory of 2256	408	k7j7Sua3JrEZNPR.exe	78
PID 408 wrote to memory of 2256	408	k7j7Sua3JrEZNPR.exe	78
PID 3024 wrote to memory of 2628	3024	Explorer.EXE	79
PID 3024 wrote to memory of 2628	3024	Explorer.EXE	79
PID 3024 wrote to memory of 2628	3024	Explorer.EXE	79
PID 2628 wrote to memory of 2064	2628	raserver.exe	80
PID 2628 wrote to memory of 2064	2628	raserver.exe	80
PID 2628 wrote to memory of 2064	2628	raserver.exe	80
PID 2628 wrote to memory of 204	2628	raserver.exe	82
PID 2628 wrote to memory of 204	2628	raserver.exe	82
PID 2628 wrote to memory of 204	2628	raserver.exe	82

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\k7j7Sua3JrEZNPR.exe
  "C:\Users\Admin\AppData\Local\Temp\k7j7Sua3JrEZNPR.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qROGyQuA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92AC.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\k7j7Sua3JrEZNPR.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:2064
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:204