formbook | b7d55f5145ac91a9b2e9d1b98f65bf6844248ebd6612be241e2fe5755dcf0733

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7
submitted
23/10/2020, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bank Receipt.exe
Size 424KB
Sample201023-8wp996fmtn
SHA256 b7d55f5145ac91a9b2e9d1b98f65bf6844248ebd6612be241e2fe5755dcf0733
MD5 87472467d8185998553cc37afce80bbd
SHA1 e4b671f691c4b067743de9e2ff2a91b534c183a1
SHA512 a3d5e2871480997b87ab89d83115afca65c1073517f3a31791a6007063ffbc884ed200e8efc12f38ee36e85c05e5d002c7dbc3baf0c22eef7c2fef1bc1c46636
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1796-3-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1796-4-0x000000000041EB80-mapping.dmp	formbook
behavioral1/memory/1172-12-0x0000000000000000-mapping.dmp	formbook

Loads dropped DLL 1 IoCs

pid	Process
240	Bank Receipt.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 240 set thread context of 1796	240	Bank Receipt.exe	25
PID 1796 set thread context of 1208	1796	Bank Receipt.exe	20
PID 1796 set thread context of 1208	1796	Bank Receipt.exe	20
PID 1172 set thread context of 1208	1172	msiexec.exe	20

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
240	Bank Receipt.exe
1796	Bank Receipt.exe
240	Bank Receipt.exe
1796	Bank Receipt.exe
1796	Bank Receipt.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe
1172	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1796	Bank Receipt.exe
1796	Bank Receipt.exe
1796	Bank Receipt.exe
1796	Bank Receipt.exe
1172	msiexec.exe
1172	msiexec.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	240	Bank Receipt.exe
Token: 33	240	Bank Receipt.exe
Token: SeIncBasePriorityPrivilege	240	Bank Receipt.exe
Token: SeDebugPrivilege	1796	Bank Receipt.exe
Token: SeDebugPrivilege	1172	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1796	240	Bank Receipt.exe	25
PID 240 wrote to memory of 1796	240	Bank Receipt.exe	25
PID 240 wrote to memory of 1796	240	Bank Receipt.exe	25
PID 240 wrote to memory of 1796	240	Bank Receipt.exe	25
PID 240 wrote to memory of 1796	240	Bank Receipt.exe	25
PID 240 wrote to memory of 1796	240	Bank Receipt.exe	25
PID 240 wrote to memory of 1796	240	Bank Receipt.exe	25
PID 240 wrote to memory of 1780	240	Bank Receipt.exe	26
PID 240 wrote to memory of 1780	240	Bank Receipt.exe	26
PID 240 wrote to memory of 1780	240	Bank Receipt.exe	26
PID 240 wrote to memory of 1780	240	Bank Receipt.exe	26
PID 240 wrote to memory of 1876	240	Bank Receipt.exe	28
PID 240 wrote to memory of 1876	240	Bank Receipt.exe	28
PID 240 wrote to memory of 1876	240	Bank Receipt.exe	28
PID 240 wrote to memory of 1876	240	Bank Receipt.exe	28
PID 1876 wrote to memory of 1908	1876	cmd.exe	30
PID 1876 wrote to memory of 1908	1876	cmd.exe	30
PID 1876 wrote to memory of 1908	1876	cmd.exe	30
PID 1876 wrote to memory of 1908	1876	cmd.exe	30
PID 240 wrote to memory of 1124	240	Bank Receipt.exe	31
PID 240 wrote to memory of 1124	240	Bank Receipt.exe	31
PID 240 wrote to memory of 1124	240	Bank Receipt.exe	31
PID 240 wrote to memory of 1124	240	Bank Receipt.exe	31
PID 1208 wrote to memory of 1172	1208	Explorer.EXE	36
PID 1208 wrote to memory of 1172	1208	Explorer.EXE	36
PID 1208 wrote to memory of 1172	1208	Explorer.EXE	36
PID 1208 wrote to memory of 1172	1208	Explorer.EXE	36
PID 1208 wrote to memory of 1172	1208	Explorer.EXE	36
PID 1208 wrote to memory of 1172	1208	Explorer.EXE	36
PID 1208 wrote to memory of 1172	1208	Explorer.EXE	36
PID 1172 wrote to memory of 1476	1172	msiexec.exe	37
PID 1172 wrote to memory of 1476	1172	msiexec.exe	37
PID 1172 wrote to memory of 1476	1172	msiexec.exe	37
PID 1172 wrote to memory of 1476	1172	msiexec.exe	37

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\Bank Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Receipt.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Users\Admin\AppData\Local\Temp\Bank Receipt.exe
    "C:/Users/Admin/AppData/Local/Temp/Bank Receipt.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Bank Receipt.exe" "%temp%\FolderN\name.exe" /Y
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
      4⤵
      PID:1908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
    3⤵
    - NTFS ADS
    PID:1124
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Bank Receipt.exe"
    3⤵
    PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-1-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/240-0-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Download

memory/1172-15-0x0000000000BA0000-0x0000000000C8A000-memory.dmp

Download

memory/1172-13-0x0000000000300000-0x0000000000314000-memory.dmp

Download

memory/1208-11-0x0000000006AB0000-0x0000000006C3D000-memory.dmp

Download

memory/1796-3-0x0000000000400000-0x000000000042E000-memory.dmp

Download