formbook | f397c24f2c684fdcd51dc9954c641d013437a78e24a5cf8c8778196a66a60372

General

Target
3BJGa7Xw4ugPpll.exe
Size 990KB
Sample201012-485rhgmfx6
SHA256 f397c24f2c684fdcd51dc9954c641d013437a78e24a5cf8c8778196a66a60372
MD5 bd4c60a45729a5f4a89191a3923b4c4a
SHA1 937ca3b95b34fe4c85664218cc7ba23c5a306376
SHA512 e02f9bcd618dee8efce714a6ce01ea5c09d400ca793bb3c2b6dbdc02ec91c231911365079cf9d1100132606b3fd07b3bc078e665138fb5621d4a0ae13764ae2d
MD5 SHA1 SHA512

Score

10^/10

rat spyware trojan stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.trusted-inspections.com/k8b/

Decoy

lulubellsgraphicsanddesigns.com
metyx.info
www423337.com
stayliveclothing.com
daluotech.com
thetruthpublished.com
pqlzlnwpz.icu
bilginhayvancilik.com
ismartdvr.com
currenibtc.com
dalesj.com
restaurantlemontblanc.com
lunarstores.com
pho-huy.com
liquidhardrive.com
bcheaplivebuy.com
evisaagency.com
houstonemergencycenter.com
alioverstreet.com
nutrhyp.com
fzwsnrbzw.icu
shesoo.com
xn--meditaoevida-7bb9c.com
hayatveren-world.com
thegamergang.com
dayforum.com
teamhoodied.com
weightm-llc.com
synertry.net
mariaclarahairstudio.com
smartnomic.com
seaecstasy.com
bestourway.com
liferiskmanager.com
myeducationnoodle.com
cooklikeaspanish.com
apacheboatsstory.com
688009.xyz
even-hand.com
therussellpinto.com
browedandbare.com
hblajiche.com
bodygoalsspa.com
adeedyworld.com
daddydomsme.com
webioff.com
respec-d.com
bitches4studs.com
shorasmedan.com
mjzmusicphotography.com
govild.com
luckyfoodexpress.com
camouflagedbeauty.com
contaclessfundraising.com
sencmil.info
highwaistedskirts.com
alanppafcommodities.com
findingthefaceofgod.com
peiqizn.com
fallgays-mobile.com
goudengoed.com
shisang.xyz
akenco-pharma.com
fishingtournament.website

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3692-2-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3692-3-0x000000000041EB90-mapping.dmp	formbook
behavioral2/memory/2996-4-0x0000000000000000-mapping.dmp	formbook

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 3692	3480	3BJGa7Xw4ugPpll.exe	77
PID 3692 set thread context of 3008	3692	3BJGa7Xw4ugPpll.exe	56
PID 2996 set thread context of 3008	2996	raserver.exe	56

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3392	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3480	3BJGa7Xw4ugPpll.exe
3480	3BJGa7Xw4ugPpll.exe
3480	3BJGa7Xw4ugPpll.exe
3692	3BJGa7Xw4ugPpll.exe
3692	3BJGa7Xw4ugPpll.exe
3692	3BJGa7Xw4ugPpll.exe
3692	3BJGa7Xw4ugPpll.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3692	3BJGa7Xw4ugPpll.exe
3692	3BJGa7Xw4ugPpll.exe
3692	3BJGa7Xw4ugPpll.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe
2996	raserver.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	3BJGa7Xw4ugPpll.exe
Token: SeDebugPrivilege	3692	3BJGa7Xw4ugPpll.exe
Token: SeDebugPrivilege	2996	raserver.exe
Token: SeShutdownPrivilege	3008	Explorer.EXE
Token: SeCreatePagefilePrivilege	3008	Explorer.EXE
Token: SeShutdownPrivilege	3008	Explorer.EXE
Token: SeCreatePagefilePrivilege	3008	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3392	3480	3BJGa7Xw4ugPpll.exe	75
PID 3480 wrote to memory of 3392	3480	3BJGa7Xw4ugPpll.exe	75
PID 3480 wrote to memory of 3392	3480	3BJGa7Xw4ugPpll.exe	75
PID 3480 wrote to memory of 3692	3480	3BJGa7Xw4ugPpll.exe	77
PID 3480 wrote to memory of 3692	3480	3BJGa7Xw4ugPpll.exe	77
PID 3480 wrote to memory of 3692	3480	3BJGa7Xw4ugPpll.exe	77
PID 3480 wrote to memory of 3692	3480	3BJGa7Xw4ugPpll.exe	77
PID 3480 wrote to memory of 3692	3480	3BJGa7Xw4ugPpll.exe	77
PID 3480 wrote to memory of 3692	3480	3BJGa7Xw4ugPpll.exe	77
PID 3008 wrote to memory of 2996	3008	Explorer.EXE	78
PID 3008 wrote to memory of 2996	3008	Explorer.EXE	78
PID 3008 wrote to memory of 2996	3008	Explorer.EXE	78
PID 2996 wrote to memory of 2784	2996	raserver.exe	79
PID 2996 wrote to memory of 2784	2996	raserver.exe	79
PID 2996 wrote to memory of 2784	2996	raserver.exe	79
PID 2996 wrote to memory of 2612	2996	raserver.exe	81
PID 2996 wrote to memory of 2612	2996	raserver.exe	81
PID 2996 wrote to memory of 2612	2996	raserver.exe	81

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\3BJGa7Xw4ugPpll.exe
  "C:\Users\Admin\AppData\Local\Temp\3BJGa7Xw4ugPpll.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zqjKWeahQXsul" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D7B.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\3BJGa7Xw4ugPpll.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:2784
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2612