formbook | 2736eab1d4bbb2dd220e5e34b8ea16a2495f6607d29f13d6314c07efc6cf757e

General

Target
javF11vuLhF2SXl.exe
Size 476KB
Sample201027-zlmtppdg26
SHA256 2736eab1d4bbb2dd220e5e34b8ea16a2495f6607d29f13d6314c07efc6cf757e
MD5 6f3233610197481a6eafcabd20759e55
SHA1 0967accaaed4dbdd2787cd9ec10a3c35f86858be
SHA512 ecf75794b7a397a0113843f110f4a970f80d73c6e5ec6ddb704a38229c14bcb9353310f7f31a006061da74735519fec71a1a9604e5c3d82472eea559bf8f50a3
MD5 SHA1 SHA512

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bfboke.com/cpi/

Decoy

tw2dl.com
cdmingjun.com
tamquin.net
shipu252.com
teamxnd02.com
finansi.website
datainnbooking.com
shannonballcoach.com
giaoruou.club
tierraycielo.com
quizfall.info
hallwayworker.guru
smartfundoptions.com
iishon11.com
zzg-wj7k9.net
mylinkbio.com
xn--kzw5tq0of14b.com
coursereel.club
koalainsulationinc.com
5ljhyr.com
mjhex.com
tacpa1.com
meadowcap.com
evalassproductions.com
ilybuy.com
recetasdecocinax.com
taxtechintelligence.com
maristafford.com
vireiautonomo.com
lahorees.com
instahawkers.com
renewedwomen.net
raudlatulmuhibbin.com
hotrodport.net
virtualensembleproject.com
discoverhp.com
portalinformasi.com
luzyverdadmiami.com
kelasonlineindie.site
ohmacey.com
titancoreholdings.com
rudrasilver.com
canandavisagovt.com
petwaterdispenserstore.com
thaluang1607.com
mofongovegano.com
hansemall.com
amesticaenterprises.com
bilzy.info
lakedip.com
perfectohydrodrills.com
thegenvalue.com
viviandsenaworld.com
blackdfw.com
801roof.net
khungtranh.net
gloryofeden.com
jennishewardart.com
stilesbuildco.com
freedomuph.com
quafecompany.com
ladyofluggage.com
casabellatranslations.com
nezzet.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/400-35-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/400-36-0x000000000041EAB0-mapping.dmp	formbook
behavioral1/memory/960-37-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1788	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 400	1036	javF11vuLhF2SXl.exe	30
PID 400 set thread context of 1212	400	javF11vuLhF2SXl.exe	20
PID 960 set thread context of 1212	960	chkdsk.exe	20

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
872	schtasks.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
400	javF11vuLhF2SXl.exe
400	javF11vuLhF2SXl.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe
960	chkdsk.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
400	javF11vuLhF2SXl.exe
400	javF11vuLhF2SXl.exe
400	javF11vuLhF2SXl.exe
960	chkdsk.exe
960	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	javF11vuLhF2SXl.exe
Token: SeDebugPrivilege	960	chkdsk.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 872	1036	javF11vuLhF2SXl.exe	28
PID 1036 wrote to memory of 872	1036	javF11vuLhF2SXl.exe	28
PID 1036 wrote to memory of 872	1036	javF11vuLhF2SXl.exe	28
PID 1036 wrote to memory of 872	1036	javF11vuLhF2SXl.exe	28
PID 1036 wrote to memory of 400	1036	javF11vuLhF2SXl.exe	30
PID 1036 wrote to memory of 400	1036	javF11vuLhF2SXl.exe	30
PID 1036 wrote to memory of 400	1036	javF11vuLhF2SXl.exe	30
PID 1036 wrote to memory of 400	1036	javF11vuLhF2SXl.exe	30
PID 1036 wrote to memory of 400	1036	javF11vuLhF2SXl.exe	30
PID 1036 wrote to memory of 400	1036	javF11vuLhF2SXl.exe	30
PID 1036 wrote to memory of 400	1036	javF11vuLhF2SXl.exe	30
PID 1212 wrote to memory of 960	1212	Explorer.EXE	42
PID 1212 wrote to memory of 960	1212	Explorer.EXE	42
PID 1212 wrote to memory of 960	1212	Explorer.EXE	42
PID 1212 wrote to memory of 960	1212	Explorer.EXE	42
PID 960 wrote to memory of 1788	960	chkdsk.exe	43
PID 960 wrote to memory of 1788	960	chkdsk.exe	43
PID 960 wrote to memory of 1788	960	chkdsk.exe	43
PID 960 wrote to memory of 1788	960	chkdsk.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\javF11vuLhF2SXl.exe
  "C:\Users\Admin\AppData\Local\Temp\javF11vuLhF2SXl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pXJkSwTPV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6B9.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\javF11vuLhF2SXl.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1340
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:548
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1060
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:480
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:696
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1404
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:616
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1364
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:520
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:320
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\javF11vuLhF2SXl.exe"
    3⤵
    - Deletes itself
    PID:1788