formbook | 77707d4b60a7193c8c7e93d9c97dcd89513ef4ce1c8e19aa6780920c09e03c27

General

Target
L3fLdu8DyoA55xo.exe
Size 671KB
Sample201027-5neeebbk2e
SHA256 77707d4b60a7193c8c7e93d9c97dcd89513ef4ce1c8e19aa6780920c09e03c27
MD5 ad45827e71cf3ef5efe845f70374b35f
SHA1 fe187d0994e5c03f2b8b93595929f1cd0d166c15
SHA512 366373b53f827d69c418d85f7c19fdb238596b46149e91ddb7685487b8b203e647b56cd2398c391fe57ef558bfef37485887dc559bec6ddcdc2285003f71df77
MD5 SHA1 SHA512

Score

10^/10

rat spyware trojan stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.trusted-inspections.com/k8b/

Decoy

lulubellsgraphicsanddesigns.com
metyx.info
www423337.com
stayliveclothing.com
daluotech.com
thetruthpublished.com
pqlzlnwpz.icu
bilginhayvancilik.com
ismartdvr.com
currenibtc.com
dalesj.com
restaurantlemontblanc.com
lunarstores.com
pho-huy.com
liquidhardrive.com
bcheaplivebuy.com
evisaagency.com
houstonemergencycenter.com
alioverstreet.com
nutrhyp.com
fzwsnrbzw.icu
shesoo.com
xn--meditaoevida-7bb9c.com
hayatveren-world.com
thegamergang.com
dayforum.com
teamhoodied.com
weightm-llc.com
synertry.net
mariaclarahairstudio.com
smartnomic.com
seaecstasy.com
bestourway.com
liferiskmanager.com
myeducationnoodle.com
cooklikeaspanish.com
apacheboatsstory.com
688009.xyz
even-hand.com
therussellpinto.com
browedandbare.com
hblajiche.com
bodygoalsspa.com
adeedyworld.com
daddydomsme.com
webioff.com
respec-d.com
bitches4studs.com
shorasmedan.com
mjzmusicphotography.com
govild.com
luckyfoodexpress.com
camouflagedbeauty.com
contaclessfundraising.com
sencmil.info
highwaistedskirts.com
alanppafcommodities.com
findingthefaceofgod.com
peiqizn.com
fallgays-mobile.com
goudengoed.com
shisang.xyz
akenco-pharma.com
fishingtournament.website

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3732-5-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3732-6-0x000000000041EB90-mapping.dmp	formbook
behavioral2/memory/3720-8-0x0000000000000000-mapping.dmp	formbook

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 496 set thread context of 3732	496	L3fLdu8DyoA55xo.exe	81
PID 3732 set thread context of 3036	3732	L3fLdu8DyoA55xo.exe	56
PID 3720 set thread context of 3036	3720	wscript.exe	56

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2700	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2627584638-3284755310-3019450177-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wscript.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
496	L3fLdu8DyoA55xo.exe
496	L3fLdu8DyoA55xo.exe
496	L3fLdu8DyoA55xo.exe
496	L3fLdu8DyoA55xo.exe
3732	L3fLdu8DyoA55xo.exe
3732	L3fLdu8DyoA55xo.exe
3732	L3fLdu8DyoA55xo.exe
3732	L3fLdu8DyoA55xo.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3732	L3fLdu8DyoA55xo.exe
3732	L3fLdu8DyoA55xo.exe
3732	L3fLdu8DyoA55xo.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe
3720	wscript.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	496	L3fLdu8DyoA55xo.exe
Token: SeDebugPrivilege	3732	L3fLdu8DyoA55xo.exe
Token: SeDebugPrivilege	3720	wscript.exe
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 2700	496	L3fLdu8DyoA55xo.exe	77
PID 496 wrote to memory of 2700	496	L3fLdu8DyoA55xo.exe	77
PID 496 wrote to memory of 2700	496	L3fLdu8DyoA55xo.exe	77
PID 496 wrote to memory of 4024	496	L3fLdu8DyoA55xo.exe	79
PID 496 wrote to memory of 4024	496	L3fLdu8DyoA55xo.exe	79
PID 496 wrote to memory of 4024	496	L3fLdu8DyoA55xo.exe	79
PID 496 wrote to memory of 4092	496	L3fLdu8DyoA55xo.exe	80
PID 496 wrote to memory of 4092	496	L3fLdu8DyoA55xo.exe	80
PID 496 wrote to memory of 4092	496	L3fLdu8DyoA55xo.exe	80
PID 496 wrote to memory of 3732	496	L3fLdu8DyoA55xo.exe	81
PID 496 wrote to memory of 3732	496	L3fLdu8DyoA55xo.exe	81
PID 496 wrote to memory of 3732	496	L3fLdu8DyoA55xo.exe	81
PID 496 wrote to memory of 3732	496	L3fLdu8DyoA55xo.exe	81
PID 496 wrote to memory of 3732	496	L3fLdu8DyoA55xo.exe	81
PID 496 wrote to memory of 3732	496	L3fLdu8DyoA55xo.exe	81
PID 3036 wrote to memory of 3720	3036	Explorer.EXE	82
PID 3036 wrote to memory of 3720	3036	Explorer.EXE	82
PID 3036 wrote to memory of 3720	3036	Explorer.EXE	82
PID 3720 wrote to memory of 3944	3720	wscript.exe	83
PID 3720 wrote to memory of 3944	3720	wscript.exe	83
PID 3720 wrote to memory of 3944	3720	wscript.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\L3fLdu8DyoA55xo.exe
  "C:\Users\Admin\AppData\Local\Temp\L3fLdu8DyoA55xo.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:496
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NequtwIygSI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD528.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\L3fLdu8DyoA55xo.exe
    "{path}"
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\L3fLdu8DyoA55xo.exe
    "{path}"
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\L3fLdu8DyoA55xo.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3720-12-0x00000000058C0000-0x00000000059A4000-memory.dmp

Download

memory/3720-11-0x00000000058C0000-0x00000000059A4000-memory.dmp

Download

memory/3720-10-0x0000000000E40000-0x0000000000E67000-memory.dmp

Download

memory/3720-9-0x0000000000E40000-0x0000000000E67000-memory.dmp

Download

memory/3732-5-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3944-14-0x00007FF7FF4B0000-0x00007FF7FF543000-memory.dmp

Download

memory/3944-15-0x00007FF7FF4B0000-0x00007FF7FF543000-memory.dmp

Download

memory/3944-16-0x00007FF7FF4B0000-0x00007FF7FF543000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads