formbook | ba9fbfd1eecd1879588201af8b4498bcef57e8950286170dbb0c7c5b7ded6a17

Analysis

max time kernel
151s
max time network
121s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTATION.exe
Size 298KB
Sample201109-5w5sd367xe
SHA256 ba9fbfd1eecd1879588201af8b4498bcef57e8950286170dbb0c7c5b7ded6a17
MD5 81776e210ce744574f3d7995018dce4f
SHA1 36cd6ce22e5d7fc8ddd142584637238100ab96b1
SHA512 521a5fe6dd1cefb861cc20e9cbcf169acc0f0a5b86f88aaf2b07243c38fd4f5bb79b4750539a3ecf3c3668d155aaf499e5dee1c283e7cc1cb9f3fa98b2594679
MD5 SHA1 SHA512

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

http://www.nyoxibwer.com/20w/

Decoy

cofounder.technology
mrbajaf.com
xn--w9s874cfjq5fk.com
haliciogluhali.net
vanessadunfordhere.com
lookguy.win
91javac.com
goldennd.com
nwatheeliteteam.net
tumpukganda.com
clarservicios.com
koghana.com
workingwithroland.com
yellowsocialbox.com
under-dawg.com
sdtjtzyz.com
banditaerialproductions.com
newssmog.com
tefnmp.men
rebelialabel.com
shubhankarthinks.com
weldlngwarehouseinc.com
cxwlkjgs.com
sfbtadvertising.com
just-climb-it.com
abigailstales.net
erreapeworld.com
ujoi0cb3td.com
adhitshet.com
loi-mezard-invest.com
shimanami-guesthouse.com
5bu3.com
koszr.info
shopgoperinnovation.com
matthiasdittert.com
stiffeducation.com
projectoverflowinc.com
v5rayp.club
dqklfr.info
jacobsonfordl.com
chicagobps.biz
bsateenalsharq.com
238bifa.com
kairui.ink
lai2151.com
simplysavvysolutions.com
watertable.win
robotica.tech
avggrfx.com
teleportcafe.com
712roofing.com
07hosting.com
quiltlux.com
implantcyrkonowy.com
gnbaccelerator.com
negusangel.com
best1caratdiamondrings.com
elizabethlampertpr.net
pinpointlocalsacramento.com
skinstradesarea.com
morganhelps.com
divarium.com
njswd.com
bfmjgame.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/568-2-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral1/memory/568-3-0x000000000041B680-mapping.dmp	formbook
behavioral1/memory/576-5-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

pid	Process
780	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 568	1080	QUOTATION.exe	33
PID 568 set thread context of 1236	568	QUOTATION.exe	21
PID 568 set thread context of 1236	568	QUOTATION.exe	21
PID 576 set thread context of 1236	576	wuapp.exe	21

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1080	QUOTATION.exe
1080	QUOTATION.exe
1080	QUOTATION.exe
568	QUOTATION.exe
568	QUOTATION.exe
568	QUOTATION.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe
576	wuapp.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
568	QUOTATION.exe
568	QUOTATION.exe
568	QUOTATION.exe
568	QUOTATION.exe
576	wuapp.exe
576	wuapp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	QUOTATION.exe
Token: SeDebugPrivilege	568	QUOTATION.exe
Token: SeDebugPrivilege	576	wuapp.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1672	1080	QUOTATION.exe	29
PID 1080 wrote to memory of 1672	1080	QUOTATION.exe	29
PID 1080 wrote to memory of 1672	1080	QUOTATION.exe	29
PID 1080 wrote to memory of 1672	1080	QUOTATION.exe	29
PID 1080 wrote to memory of 268	1080	QUOTATION.exe	31
PID 1080 wrote to memory of 268	1080	QUOTATION.exe	31
PID 1080 wrote to memory of 268	1080	QUOTATION.exe	31
PID 1080 wrote to memory of 268	1080	QUOTATION.exe	31
PID 1080 wrote to memory of 756	1080	QUOTATION.exe	32
PID 1080 wrote to memory of 756	1080	QUOTATION.exe	32
PID 1080 wrote to memory of 756	1080	QUOTATION.exe	32
PID 1080 wrote to memory of 756	1080	QUOTATION.exe	32
PID 1080 wrote to memory of 568	1080	QUOTATION.exe	33
PID 1080 wrote to memory of 568	1080	QUOTATION.exe	33
PID 1080 wrote to memory of 568	1080	QUOTATION.exe	33
PID 1080 wrote to memory of 568	1080	QUOTATION.exe	33
PID 1080 wrote to memory of 568	1080	QUOTATION.exe	33
PID 1080 wrote to memory of 568	1080	QUOTATION.exe	33
PID 1080 wrote to memory of 568	1080	QUOTATION.exe	33
PID 568 wrote to memory of 576	568	QUOTATION.exe	34
PID 568 wrote to memory of 576	568	QUOTATION.exe	34
PID 568 wrote to memory of 576	568	QUOTATION.exe	34
PID 568 wrote to memory of 576	568	QUOTATION.exe	34
PID 568 wrote to memory of 576	568	QUOTATION.exe	34
PID 568 wrote to memory of 576	568	QUOTATION.exe	34
PID 568 wrote to memory of 576	568	QUOTATION.exe	34
PID 576 wrote to memory of 780	576	wuapp.exe	35
PID 576 wrote to memory of 780	576	wuapp.exe	35
PID 576 wrote to memory of 780	576	wuapp.exe	35
PID 576 wrote to memory of 780	576	wuapp.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1236
- C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QbvhOdexBAoua" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE7CF.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
    "{path}"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
    "{path}"
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\SysWOW64\wuapp.exe
      "C:\Windows\SysWOW64\wuapp.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:576
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"
        5⤵
        Deletes itself
        
        PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-2-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/576-6-0x0000000001060000-0x000000000106B000-memory.dmp

Download

memory/576-8-0x00000000008D0000-0x00000000009BD000-memory.dmp

Download

memory/1236-4-0x0000000004AA0000-0x0000000004B78000-memory.dmp

Download

memory/1236-9-0x0000000007650000-0x00000000077C0000-memory.dmp

Download