formbook | b43bca6dcc03b6c289b15fd6dde4bde2dee13d024f08b0ca47efefc9d9aa3d8c

General

Target
1TOFpZKvqyRVuuy.exe
Size 302KB
Sample201109-g9sk19dexj
SHA256 b43bca6dcc03b6c289b15fd6dde4bde2dee13d024f08b0ca47efefc9d9aa3d8c
MD5 4a15e3620504681438565df947f5a702
SHA1 750e4c022b615a9cc9ff4a8ebb3091e66244815f
SHA512 60d107c9a2d75c899919a69f55020ca60053ce164a8a796af78202fa1b56127c595d7b846da36c22da16390e1f0d51fdfca7902e8d7e25b3735115c16f4472e4
MD5 SHA1 SHA512

Score

10^/10

formbook evasion rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.spatren.com/duj/

Decoy

deapink.pink
tkmdz.com
nytzshicai.com
photos-identite-dijon.com
ekanun.net
xn--fiqy4bxl57l9sag6f6wb.ink
slivercat5.com
ai-ethics.net
510ns.com
inotherways.com
ridesharesettelment.com
zjxiangnong.com
aoraessentials.com
sheap-list.com
heshengqy.com
experts-comptables-paris-17.com
parissummerolympics2024.info
gtyx88.com
devopsonjob.com
vodacred.com
kandilakes.com
digitalcoincollective.com
seedrazer.com
24houremergencyroomnearme.com
xn--lg3bu5if3f.com
557486.top
czqfkj.com
running0711.com
aimwizard.com
holdingtoken.com
qgyldzw.com
mt1618.com
chiquicreates.com
0pe345.com
shopmomsthebomb.com
cheerzhangover.com
tascoxuanphuong.info
suitablepersonalprotection.com
dh12345.com
pixelfocusphotography.com
tianhegongcheng.com
foodsweet.com
hoamailand.com
btr96.info
eatsmartcookie.com
studebakergs.com
110422.info
infoicobit.com
northeastphillyshuttle.com
lover-road.com
pacificsolo.com
intangiblebitcoin.info
quericus.tech
indianchemicalmart.com
trublueroanokeva.com
apollontimes.news
interiordesignersudbury.com
klarkindustria.com
fraisgr.com
marketersarbitrage.com
adoriagroep.com
hxjfqe.com
stoneandstran.com
genkicoffee.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1664-2-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1664-3-0x000000000041E2E0-mapping.dmp	formbook
behavioral1/memory/588-4-0x0000000000000000-mapping.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1TOFpZKvqyRVuuy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1TOFpZKvqyRVuuy.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	1TOFpZKvqyRVuuy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	1TOFpZKvqyRVuuy.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 644 set thread context of 1664	644	1TOFpZKvqyRVuuy.exe	32
PID 1664 set thread context of 1264	1664	MSBuild.exe	21
PID 588 set thread context of 1264	588	wlanext.exe	21

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
644	1TOFpZKvqyRVuuy.exe
644	1TOFpZKvqyRVuuy.exe
644	1TOFpZKvqyRVuuy.exe
1664	MSBuild.exe
1664	MSBuild.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe
588	wlanext.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1664	MSBuild.exe
1664	MSBuild.exe
1664	MSBuild.exe
588	wlanext.exe
588	wlanext.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	1TOFpZKvqyRVuuy.exe
Token: SeDebugPrivilege	1664	MSBuild.exe
Token: SeDebugPrivilege	588	wlanext.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1008	644	1TOFpZKvqyRVuuy.exe	30
PID 644 wrote to memory of 1008	644	1TOFpZKvqyRVuuy.exe	30
PID 644 wrote to memory of 1008	644	1TOFpZKvqyRVuuy.exe	30
PID 644 wrote to memory of 1008	644	1TOFpZKvqyRVuuy.exe	30
PID 644 wrote to memory of 1664	644	1TOFpZKvqyRVuuy.exe	32
PID 644 wrote to memory of 1664	644	1TOFpZKvqyRVuuy.exe	32
PID 644 wrote to memory of 1664	644	1TOFpZKvqyRVuuy.exe	32
PID 644 wrote to memory of 1664	644	1TOFpZKvqyRVuuy.exe	32
PID 644 wrote to memory of 1664	644	1TOFpZKvqyRVuuy.exe	32
PID 644 wrote to memory of 1664	644	1TOFpZKvqyRVuuy.exe	32
PID 644 wrote to memory of 1664	644	1TOFpZKvqyRVuuy.exe	32
PID 1264 wrote to memory of 588	1264	Explorer.EXE	33
PID 1264 wrote to memory of 588	1264	Explorer.EXE	33
PID 1264 wrote to memory of 588	1264	Explorer.EXE	33
PID 1264 wrote to memory of 588	1264	Explorer.EXE	33
PID 588 wrote to memory of 568	588	wlanext.exe	34
PID 588 wrote to memory of 568	588	wlanext.exe	34
PID 588 wrote to memory of 568	588	wlanext.exe	34
PID 588 wrote to memory of 568	588	wlanext.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\1TOFpZKvqyRVuuy.exe
  "C:\Users\Admin\AppData\Local\Temp\1TOFpZKvqyRVuuy.exe"
  2⤵
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NgLQLPa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5235.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1008
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\Windows\SysWOW64\wlanext.exe
  "C:\Windows\SysWOW64\wlanext.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
    3⤵
    PID:568