formbook | 11bd0634bb7c4af4391c544efdf458686bc52b75ce6919469ad01e7bf11bdb1a

General

Target
Scan_Doc_11052020.exe
Size 424KB
Sample201109-4m3scmx2qs
SHA256 11bd0634bb7c4af4391c544efdf458686bc52b75ce6919469ad01e7bf11bdb1a
MD5 cd52258b721f167e1af247528009c305
SHA1 afa8af35629c35ce91c5c6065ce31cef69bbb0a0
SHA512 036a258b30e6b661fc5f2f21f3449188ee6f978f88013cd0b64a40ddb1365cdf2648fdfc97e596dbd401ddc5a4ab156c753d2dda568742df1243db6f746247ca
MD5 SHA1 SHA512

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.porcber.com/mq3/

Decoy

vamojunto.com
zhuiju5.com
brxer.com
modnevesht.com
qadmin.com
yyw518.com
diacleaningservice.com
like-net.com
mallscbd.com
remdee.com
salonyu-mie.com
bookwormegy.com
mymtaporta.com
usepelican.com
nam2store.com
ubench.net
techsupportnumber.directory
globalkeystone.info
computerhomebasedbusinesses.com
yx956.com
zcs-edu.com
r2019.biz
acgjqi.biz
dd1226.com
dqb-06rnty-ftf3.com
scratch-kings.com
samdeng.works
ecotero.com
tilalbaghdad.com
tsceecee.com
luxeprovisionschateau.com
carnescolombia.services
marcinkulik.com
dearisorealestate.com
ebonysnetwork.com
hellsoasis.net
nestvacation.com
savingyourphotos.com
colectfly.com
robertsonknives.net
pharmaluk-processing.com
bridgejfc.com
ccgan22.com
worldtravellersblog.com
smsjtj.com
bizdiagnosis.com
kongjiayao.com
3dlasermaroc.com
kingbei.net
about-shopping.com
meetlove94.life
lit-investmentcenter.com
dipper.rocks
xavnzfw.com
shimi783.info
misseshippies.com
kafakoc.com
matbaadukkanim.com
brandbank.news
dllearn.com
bzasd.com
axcyl.com
ourdailygoals.com
riosdepremios.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1660-4-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1292	cmd.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Scan_Doc_11052020.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Scan_Doc_11052020.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1040 set thread context of 1196	1040	Scan_Doc_11052020.exe	21
PID 1660 set thread context of 1196	1660	msiexec.exe	21

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1040	Scan_Doc_11052020.exe
1040	Scan_Doc_11052020.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1040	Scan_Doc_11052020.exe
1040	Scan_Doc_11052020.exe
1040	Scan_Doc_11052020.exe
1660	msiexec.exe
1660	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	Scan_Doc_11052020.exe
Token: SeDebugPrivilege	1660	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	31
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	31
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	31
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	31
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	31
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	31
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	31
PID 1660 wrote to memory of 1292	1660	msiexec.exe	32
PID 1660 wrote to memory of 1292	1660	msiexec.exe	32
PID 1660 wrote to memory of 1292	1660	msiexec.exe	32
PID 1660 wrote to memory of 1292	1660	msiexec.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\Scan_Doc_11052020.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan_Doc_11052020.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1040
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1592
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Scan_Doc_11052020.exe"
    3⤵
    - Deletes itself
    PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-0-0x0000000074900000-0x0000000074FEE000-memory.dmp

Download

memory/1040-1-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/1040-3-0x0000000000B80000-0x0000000000BB1000-memory.dmp

Download

memory/1660-5-0x0000000000150000-0x0000000000164000-memory.dmp

Download

memory/1660-7-0x00000000030E0000-0x0000000003252000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads