formbook | c18c5e02d67ca2dea08e13f3731c5dd0f5d8833bf2b606287c97e1d053564b85

General

Target
ORDER LIST.exe
Size 579KB
Sample201109-lnjgpthv3x
SHA256 c18c5e02d67ca2dea08e13f3731c5dd0f5d8833bf2b606287c97e1d053564b85
MD5 42487f802a35746bf11d808133837801
SHA1 593369fa8fac39294cfd6a3e476d4e1ce34ca0b8
SHA512 ffa1bb4f1566a6412a3e2657a867c1951c440e2dfcb6e857dd5422bc9475fc169801578ab89717e8c143a81362a9461469a0de1c45c270012c58c0bee2c99dba
MD5 SHA1 SHA512

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bottrader.digital/d8h/

Decoy

citizen10.com
shalynmusic.com
jerseycoastcollectibles.com
ilginozgul.academy
meralbilkay.com
sparkasse-suedpfalz.net
blackbeltbeef.farm
careermoatsbook.com
angiesaludable.com
9y9y9.xyz
freyafallen.com
cbluebelt3dwdbuy.com
steeltownlabs.com
maskupforschool.com
unicornnotary.com
erometa.com
albumofindia.online
danhuman.com
denizlidekep.com
kenna.foundation
phone-avail18.club
kanbachi.com
oahmxiakia5.com
erpsystem.site
magentnew.com
wesportscity.com
theclubibiza.com
pidoo.pet
treehaire.com
moto-sure.com
konsultanjasa.com
nvschoolology.com
bohecdk.net
fieldstoneweb.com
vivatecworld.com
locobugs.com
ubestedu.com
aioffice.net
chaoscraftsonthesidellc.com
hiddenhillsgems.com
ececircuit.com
anaejoao2021.com
igensheets.com
winemakingkit.net
toplegallawfirm.com
talayer.com
keepamericansgreatagain.com
hendieboards.com
interaction-logistics.com
shpanyang.com
cooslickgin.com
circuswiththestars.com
couple.chat
officialvantop.com
eaeqc.com
matu-edu.com
theseeingglass.com
winkwinx.com
5661933.com
sbsx.online
happysnackbaggin.com
piscanc.net
griffinmcshane.com
elvinejacketsonline.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1660-7-0x000000000041CA20-mapping.dmp	formbook
behavioral1/memory/1660-6-0x0000000000400000-0x0000000000428000-memory.dmp	formbook
behavioral1/memory/1064-8-0x0000000000000000-mapping.dmp	formbook

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1660	1688	ORDER LIST.exe	29
PID 1660 set thread context of 1248	1660	vbc.exe	21
PID 1064 set thread context of 1248	1064	msiexec.exe	21

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1660	vbc.exe
1660	vbc.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe
1064	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1660	vbc.exe
1660	vbc.exe
1660	vbc.exe
1064	msiexec.exe
1064	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	vbc.exe
Token: SeDebugPrivilege	1064	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1660	1688	ORDER LIST.exe	29
PID 1688 wrote to memory of 1660	1688	ORDER LIST.exe	29
PID 1688 wrote to memory of 1660	1688	ORDER LIST.exe	29
PID 1688 wrote to memory of 1660	1688	ORDER LIST.exe	29
PID 1688 wrote to memory of 1660	1688	ORDER LIST.exe	29
PID 1688 wrote to memory of 1660	1688	ORDER LIST.exe	29
PID 1688 wrote to memory of 1660	1688	ORDER LIST.exe	29
PID 1248 wrote to memory of 1064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 1064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 1064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 1064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 1064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 1064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 1064	1248	Explorer.EXE	30
PID 1064 wrote to memory of 564	1064	msiexec.exe	31
PID 1064 wrote to memory of 564	1064	msiexec.exe	31
PID 1064 wrote to memory of 564	1064	msiexec.exe	31
PID 1064 wrote to memory of 564	1064	msiexec.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\ORDER LIST.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER LIST.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-9-0x00000000000B0000-0x00000000000C4000-memory.dmp

Download

memory/1064-11-0x0000000002000000-0x0000000002103000-memory.dmp

Download

memory/1660-6-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1688-0-0x0000000074110000-0x00000000747FE000-memory.dmp

Download

memory/1688-1-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/1688-3-0x00000000002C0000-0x00000000002CB000-memory.dmp

Download

memory/1688-4-0x0000000002140000-0x000000000219F000-memory.dmp

Download

memory/1688-5-0x0000000000AE0000-0x0000000000B0B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads