formbook | 27c9bdfa6cc8c9343b507ee1df148482028afcabda152e356feabd28ecd67eb5

General

Target
New Purchase Order 501,689$.exe
Size 776KB
Sample201014-95ekg3zrn2
SHA256 27c9bdfa6cc8c9343b507ee1df148482028afcabda152e356feabd28ecd67eb5
MD5 7eb4a098afeb697225602abfb7d9271b
SHA1 857ee7a930c58ef351cc24178583936aae8f6c50
SHA512 b0a044f8e7ecd67bfd96fa3b9245a6c3eea54d65025b620f86556be94a4213ee3016bb8d094f36e5de6b57f4f3ca464f108f45a1477c9e424afeec48d168354e
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.touchtoby.xyz/eao/

Decoy

littletram.com
vanmetaal.com
clubbingspringbreak.com
intohuman.com
steph.place
ipsumksa.com
paultoon.com
wocwebowecbweogw.com
beverlyhillsmerch.com
vans-athens.com
stylishnailsbyem.com
milletvit.com
pappyjacksburgershack.com
anal-liza.com
lotownerbuilders.com
caffinatics.com
cvbtrading.co.uk
pheasanttrailsgolfcourse.com
wed0888.com
sundeepm.com
moneymakersclub.net
candcsaptai.com
skogsframjandet.com
rockstarpartyrentals.com
prostylezhairsalon.com
rogue.football
selfsufficientlearners.com
wisdom-consult.com
pivicric.info
domainemariage.com
mathsforstudents.com
wowdaebak.com
linbook8888.com
exceeidt.com
aicebit.com
ncgf61.com
argenteriamantova.com
hey-bamboo.com
elgritodeharpo.com
realbrosofles.com
5766557.com
galileomkt.com
astrugar.com
haasmyasupportagency.com
power-realestate.com
14201shastaway.com
solofsantabarbara.com
magentnew.com
xuedaiting.com
accokeektvmounting.com
ressindia.com
abuju.com
commcheapshop.com
indokaryasm.com
taddle.one
economicdevelopmentsoftware.com
fayk222.icu
4winner.xyz
undefinedheightsinc.com
sunfloe.com
xp135.com
simoncablehair.com
condor-protection.com
dentoviaoneday.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1988-6-0x0000000000400000-0x0000000000428000-memory.dmp	formbook
behavioral1/memory/1988-7-0x000000000041C810-mapping.dmp	formbook
behavioral1/memory/1040-9-0x0000000000000000-mapping.dmp	formbook

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 1988	1448	New Purchase Order 501,689$.exe	28
PID 1988 set thread context of 1312	1988	vbc.exe	20
PID 1988 set thread context of 1312	1988	vbc.exe	20
PID 1040 set thread context of 1312	1040	rundll32.exe	20

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1448	New Purchase Order 501,689$.exe
1448	New Purchase Order 501,689$.exe
1988	vbc.exe
1988	vbc.exe
1988	vbc.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1988	vbc.exe
1988	vbc.exe
1988	vbc.exe
1988	vbc.exe
1040	rundll32.exe
1040	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	New Purchase Order 501,689$.exe
Token: SeDebugPrivilege	1988	vbc.exe
Token: SeDebugPrivilege	1040	rundll32.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1988	1448	New Purchase Order 501,689$.exe	28
PID 1448 wrote to memory of 1988	1448	New Purchase Order 501,689$.exe	28
PID 1448 wrote to memory of 1988	1448	New Purchase Order 501,689$.exe	28
PID 1448 wrote to memory of 1988	1448	New Purchase Order 501,689$.exe	28
PID 1448 wrote to memory of 1988	1448	New Purchase Order 501,689$.exe	28
PID 1448 wrote to memory of 1988	1448	New Purchase Order 501,689$.exe	28
PID 1448 wrote to memory of 1988	1448	New Purchase Order 501,689$.exe	28
PID 1312 wrote to memory of 1040	1312	Explorer.EXE	29
PID 1312 wrote to memory of 1040	1312	Explorer.EXE	29
PID 1312 wrote to memory of 1040	1312	Explorer.EXE	29
PID 1312 wrote to memory of 1040	1312	Explorer.EXE	29
PID 1312 wrote to memory of 1040	1312	Explorer.EXE	29
PID 1312 wrote to memory of 1040	1312	Explorer.EXE	29
PID 1312 wrote to memory of 1040	1312	Explorer.EXE	29
PID 1040 wrote to memory of 2040	1040	rundll32.exe	30
PID 1040 wrote to memory of 2040	1040	rundll32.exe	30
PID 1040 wrote to memory of 2040	1040	rundll32.exe	30
PID 1040 wrote to memory of 2040	1040	rundll32.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\New Purchase Order 501,689$.exe
  "C:\Users\Admin\AppData\Local\Temp\New Purchase Order 501,689$.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-10-0x0000000000F30000-0x0000000000F3E000-memory.dmp

Download

memory/1040-12-0x00000000035A0000-0x0000000003718000-memory.dmp

Download

memory/1312-8-0x00000000069F0000-0x0000000006B09000-memory.dmp

Download

memory/1448-0-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Download

memory/1448-1-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/1448-3-0x0000000000600000-0x0000000000604000-memory.dmp

Download

memory/1448-4-0x00000000050C0000-0x0000000005135000-memory.dmp

Download

memory/1448-5-0x0000000000560000-0x00000000005C2000-memory.dmp

Download

memory/1988-6-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads