formbook | a35a1149597435d58703ab662e49dab5ccc96d77529ebacefcdcf9e298c27e51

General

Target
SWIFT polizza di versamento.exe
Size 1014KB
Sample201109-54ted69ces
SHA256 a35a1149597435d58703ab662e49dab5ccc96d77529ebacefcdcf9e298c27e51
MD5 324b9c9d6e2ba577e659b7d84852b4cd
SHA1 9327b4ecb17c2369d312e5d06dc02830611bc7a4
SHA512 1e6729ef067ac27317c95a2de8f94e8e58d03ea6e13465d793de2602a0d74090076a1867544d35ceb6fa880b0047e2338617532e52841d3be0ebd7cc8d142c8e
MD5 SHA1 SHA512

Score

10^/10

formbook modiloader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.joomlas123.info/n7ak/

Decoy

audereventur.com
huro14.com
wwwjinsha155.com
antiquevendor.com
samuraisoulfood.net
traffic4updates.download
hypersarv.com
rapport-happy-wedding.com
rokutechnosupport.online
allworljob.com
hanaleedossmann.com
kauai-marathon.com
bepbosch.com
kangen-international.com
zoneshopemenowz.com
belviderewrestling.com
ipllink.com
sellingforcreators.com
wwwswty6655.com
qtumboa.com
bazarmoney.net
librosdecienciaficcion.com
shopmomsthebomb.com
vanjacob.com
tgyaa.com
theporncollective.net
hydrabadproperties.com
brindesecologicos.com
sayagayrimenkul.net
4btoken.com
shycedu.com
overall789.top
maison-pierre-bayle.com
elitemediamasters.com
sharmasfabrics.com
hoshamp.com
myultimateleadgenerator.com
office4u.info
thaimart1.com
ultimatewindowusa.com
twoblazesartworks.com
airteloffer.com
shoupaizhao.com
741dakotadr.info
books4arab.net
artedelcioccolato.biz
tjqcu.info
teccoop.net
maturebridesdressguide.com
excelcapfunding.com
bitcoinak.com
profileorderflow.com
unbelievabowboutique.com
midlandshomesolutionsltd.com
healthywithhook.com
stirlingpiper.com
manfast.online
arikorin.com
texastrustedinsurance.com
moodandmystery.com
yh77808.com
s-immotanger.com
runzexd.com
meteoannecy.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1236-1-0x000000000041E380-mapping.dmp	formbook
behavioral1/memory/1236-0-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1512-3-0x0000000000000000-mapping.dmp	formbook

Adds policy Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ipconfig.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\KV1HBN_H16 = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe"	ipconfig.exe
Key created	\Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ipconfig.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 288 set thread context of 1236	288	SWIFT polizza di versamento.exe	29
PID 1236 set thread context of 1220	1236	ieinstal.exe	21
PID 1236 set thread context of 1220	1236	ieinstal.exe	21
PID 1512 set thread context of 1220	1512	ipconfig.exe	21

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1512	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	ipconfig.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1236	ieinstal.exe
1236	ieinstal.exe
1236	ieinstal.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1236	ieinstal.exe
1236	ieinstal.exe
1236	ieinstal.exe
1236	ieinstal.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe
1512	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	ieinstal.exe
Token: SeDebugPrivilege	1512	ipconfig.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 288 wrote to memory of 1236	288	SWIFT polizza di versamento.exe	29
PID 1220 wrote to memory of 1512	1220	Explorer.EXE	30
PID 1220 wrote to memory of 1512	1220	Explorer.EXE	30
PID 1220 wrote to memory of 1512	1220	Explorer.EXE	30
PID 1220 wrote to memory of 1512	1220	Explorer.EXE	30
PID 1512 wrote to memory of 112	1512	ipconfig.exe	32
PID 1512 wrote to memory of 112	1512	ipconfig.exe	32
PID 1512 wrote to memory of 112	1512	ipconfig.exe	32
PID 1512 wrote to memory of 112	1512	ipconfig.exe	32
PID 1512 wrote to memory of 112	1512	ipconfig.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\SWIFT polizza di versamento.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT polizza di versamento.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:288
- - C:\Program Files (x86)\internet explorer\ieinstal.exe
    "C:\Program Files (x86)\internet explorer\ieinstal.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:112