formbook | 9e9cdc29fefbbbe68a8341df4d3102bac12031106e1f14d1185f57a787a7447b

General

Target
QiKJCf8SJcQ3BuP.exe
Size 542KB
Sample201027-7l2eaewsa2
SHA256 9e9cdc29fefbbbe68a8341df4d3102bac12031106e1f14d1185f57a787a7447b
MD5 ef328f74499754a472157825f620e917
SHA1 4112900035d6a3ea4955a16f16a75995e33dcef8
SHA512 dbe470cd288948ca549fd53800f7d67dfbc90d765913c151766691001938a593ef3be4264ec9dc7cb958a2fb7e2b1c9b7a289a83e2031ba16c7182b16b2cd266
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.bfboke.com/cpi/

Decoy

tw2dl.com
cdmingjun.com
tamquin.net
shipu252.com
teamxnd02.com
finansi.website
datainnbooking.com
shannonballcoach.com
giaoruou.club
tierraycielo.com
quizfall.info
hallwayworker.guru
smartfundoptions.com
iishon11.com
zzg-wj7k9.net
mylinkbio.com
xn--kzw5tq0of14b.com
coursereel.club
koalainsulationinc.com
5ljhyr.com
mjhex.com
tacpa1.com
meadowcap.com
evalassproductions.com
ilybuy.com
recetasdecocinax.com
taxtechintelligence.com
maristafford.com
vireiautonomo.com
lahorees.com
instahawkers.com
renewedwomen.net
raudlatulmuhibbin.com
hotrodport.net
virtualensembleproject.com
discoverhp.com
portalinformasi.com
luzyverdadmiami.com
kelasonlineindie.site
ohmacey.com
titancoreholdings.com
rudrasilver.com
canandavisagovt.com
petwaterdispenserstore.com
thaluang1607.com
mofongovegano.com
hansemall.com
amesticaenterprises.com
bilzy.info
lakedip.com
perfectohydrodrills.com
thegenvalue.com
viviandsenaworld.com
blackdfw.com
801roof.net
khungtranh.net
gloryofeden.com
jennishewardart.com
stilesbuildco.com
freedomuph.com
quafecompany.com
ladyofluggage.com
casabellatranslations.com
nezzet.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1988-2-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1988-3-0x000000000041EAB0-mapping.dmp	formbook
behavioral1/memory/1080-4-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

pid	Process
2032	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 1988	1488	QiKJCf8SJcQ3BuP.exe	30
PID 1988 set thread context of 1236	1988	QiKJCf8SJcQ3BuP.exe	20
PID 1080 set thread context of 1236	1080	wininit.exe	20

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1988	QiKJCf8SJcQ3BuP.exe
1988	QiKJCf8SJcQ3BuP.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe
1080	wininit.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1988	QiKJCf8SJcQ3BuP.exe
1988	QiKJCf8SJcQ3BuP.exe
1988	QiKJCf8SJcQ3BuP.exe
1080	wininit.exe
1080	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	QiKJCf8SJcQ3BuP.exe
Token: SeDebugPrivilege	1080	wininit.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1588	1488	QiKJCf8SJcQ3BuP.exe	28
PID 1488 wrote to memory of 1588	1488	QiKJCf8SJcQ3BuP.exe	28
PID 1488 wrote to memory of 1588	1488	QiKJCf8SJcQ3BuP.exe	28
PID 1488 wrote to memory of 1588	1488	QiKJCf8SJcQ3BuP.exe	28
PID 1488 wrote to memory of 1988	1488	QiKJCf8SJcQ3BuP.exe	30
PID 1488 wrote to memory of 1988	1488	QiKJCf8SJcQ3BuP.exe	30
PID 1488 wrote to memory of 1988	1488	QiKJCf8SJcQ3BuP.exe	30
PID 1488 wrote to memory of 1988	1488	QiKJCf8SJcQ3BuP.exe	30
PID 1488 wrote to memory of 1988	1488	QiKJCf8SJcQ3BuP.exe	30
PID 1488 wrote to memory of 1988	1488	QiKJCf8SJcQ3BuP.exe	30
PID 1488 wrote to memory of 1988	1488	QiKJCf8SJcQ3BuP.exe	30
PID 1236 wrote to memory of 1080	1236	Explorer.EXE	31
PID 1236 wrote to memory of 1080	1236	Explorer.EXE	31
PID 1236 wrote to memory of 1080	1236	Explorer.EXE	31
PID 1236 wrote to memory of 1080	1236	Explorer.EXE	31
PID 1080 wrote to memory of 2032	1080	wininit.exe	32
PID 1080 wrote to memory of 2032	1080	wininit.exe	32
PID 1080 wrote to memory of 2032	1080	wininit.exe	32
PID 1080 wrote to memory of 2032	1080	wininit.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\QiKJCf8SJcQ3BuP.exe
  "C:\Users\Admin\AppData\Local\Temp\QiKJCf8SJcQ3BuP.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bifeQCQxWO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE28.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\QiKJCf8SJcQ3BuP.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- C:\Windows\SysWOW64\wininit.exe
  "C:\Windows\SysWOW64\wininit.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\QiKJCf8SJcQ3BuP.exe"
    3⤵
    - Deletes itself
    PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-5-0x0000000000710000-0x000000000072A000-memory.dmp

Download

memory/1080-7-0x0000000003000000-0x0000000003101000-memory.dmp

Download

memory/1988-2-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads