formbook | d606ad2f22a8def869afd7e352766c880404a40948ac435d62d136ea7d61efcc

General

Target
PO#5099655_PDF.exe
Size 622KB
Sample201109-945rfcl2n2
SHA256 d606ad2f22a8def869afd7e352766c880404a40948ac435d62d136ea7d61efcc
MD5 8064e37c00d515ab176fdfd48b40bde5
SHA1 620be0d274ef45cc17cbef8623a8d3516c9983eb
SHA512 251332583f69eed85b3b28ed26b68c39ce018b822e9f27419b8c2991c3d62403105f5769e269373e55a3215cb52201255296d64fdac247cba3ab8952ad36791f
MD5 SHA1 SHA512

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.porcber.com/b5c/

Decoy

cyb-eight.com
preciso-de-dinheiro-urgente.com
ddanceboutique.com
workerid.com
maidsmyway.net
l5-2rich.com
lifecreatestyle.com
xn--nachschlssel-klb.com
pregallery.com
koolbeli.com
seprh.com
balootweb.com
376nvx.info
ecardrive.com
northcountysdkids.com
leminhezuoshe.com
uploadmetothe.cloud
privatepracticeangels.com
bourse-boursorama.net
amberree.com
laenq9p-dyu.com
larissapasut.com
portlandvivint.info
barqelezz.com
dingfujr.com
cheapvacaation.com
sircoloumbdesign.com
bt3737.com
revelationriders.com
daishholidays.com
faduc.com
woniu.store
0165d.com
liusjlawyer.com
autokonzept-de.com
cameocn.com
elleaholmes.com
blogtocast.com
treasure.support
visionfinancialcorp.net
praisedshoes.com
mainstreetoftexas.com
jmcp-particular.com
eretearn.com
ribory.com
idjungle.com
bbluav82.com
laurelbrooksfarm.com
spalick.com
alterragold.com
find520.net
theothernotebook.com
waterbottlegear.com
givegetswitch.net
pengyuqipei.com
bboutiq.com
lothlogistics.com
gdaxup.info
globalprogressions.com
bmwlakebluff.com
hqcjjy.com
indusfan.com
kenyaworks.com
destination.today

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1620-2-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral1/memory/1620-3-0x000000000041B5F0-mapping.dmp	formbook
behavioral1/memory/1664-9-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1632	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 1620	1808	PO#5099655_PDF.exe	29
PID 1620 set thread context of 1244	1620	PO#5099655_PDF.exe	21
PID 1664 set thread context of 1244	1664	ipconfig.exe	21

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1664	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1808	PO#5099655_PDF.exe
1620	PO#5099655_PDF.exe
1620	PO#5099655_PDF.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe
1664	ipconfig.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1620	PO#5099655_PDF.exe
1620	PO#5099655_PDF.exe
1620	PO#5099655_PDF.exe
1664	ipconfig.exe
1664	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	PO#5099655_PDF.exe
Token: SeDebugPrivilege	1620	PO#5099655_PDF.exe
Token: SeDebugPrivilege	1664	ipconfig.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1620	1808	PO#5099655_PDF.exe	29
PID 1808 wrote to memory of 1620	1808	PO#5099655_PDF.exe	29
PID 1808 wrote to memory of 1620	1808	PO#5099655_PDF.exe	29
PID 1808 wrote to memory of 1620	1808	PO#5099655_PDF.exe	29
PID 1808 wrote to memory of 1620	1808	PO#5099655_PDF.exe	29
PID 1808 wrote to memory of 1620	1808	PO#5099655_PDF.exe	29
PID 1808 wrote to memory of 1620	1808	PO#5099655_PDF.exe	29
PID 1244 wrote to memory of 1664	1244	Explorer.EXE	30
PID 1244 wrote to memory of 1664	1244	Explorer.EXE	30
PID 1244 wrote to memory of 1664	1244	Explorer.EXE	30
PID 1244 wrote to memory of 1664	1244	Explorer.EXE	30
PID 1664 wrote to memory of 1632	1664	ipconfig.exe	31
PID 1664 wrote to memory of 1632	1664	ipconfig.exe	31
PID 1664 wrote to memory of 1632	1664	ipconfig.exe	31
PID 1664 wrote to memory of 1632	1664	ipconfig.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\PO#5099655_PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#5099655_PDF.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\PO#5099655_PDF.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\PO#5099655_PDF.exe"
    3⤵
    - Deletes itself
    PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-2-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1664-10-0x00000000005C0000-0x00000000005CA000-memory.dmp

Download

memory/1664-12-0x0000000002010000-0x00000000020F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads