formbook | 6c45a4d4ed82e89fc389c64729ef65d08fa313ad92e0818f6c1fa96156d66f4e

General

Target
SWIFT COPY.exe
Size 335KB
Sample201109-pd47bzz7vn
SHA256 6c45a4d4ed82e89fc389c64729ef65d08fa313ad92e0818f6c1fa96156d66f4e
MD5 ebabed291602498abfacc0fb8df14fd8
SHA1 e5af4842b739d854e771620fca42a357ccb5781b
SHA512 aeedb753c3a38c5d88e5be1be95455f6ba1366830f5a256875b7e0a64bb983719327bfbbf978e2e23e07506874ca59d4ba57e0d11735e6443e9d4c86e1e99b6a
MD5 SHA1 SHA512

Score

10^/10

formbook evasion rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.mansiobok3.info/ch62/

Decoy

priceground.com
protmaxvigilancia.com
allyboom.com
calimerkids.com
behproject.com
everxs.com
peertopeervaluetrading.com
asosdiscountscode.com
supersoloblitz.com
allindiaexpo.com
mountainpunks.com
lawberrys.com
myinsuranceclaimconsultants.com
autoberles.center
xn--circuitomioulla-7qb.com
beheartratemonitoringkey.live
bigcitypillows.com
tresriosresortoffers.com
ratmanrodentremoval.com
fujiaseed.com
140117.com
babyandkidexpo.com
bolduan-electronic.com
unreadytowear.com
portsaid.today
5oo50042.com
qiangbaoshou.net
hoptovine.com
coastalchiropracticcoverage.com
abeabogado.com
dancourvilleclhev.com
opebet915.com
justin-freeman.com
foodpursuits.com
pinjuanbao.com
900gamecz.com
andelmanconsulting.com
milandicic.com
airexpertservices.com
leaginac.com
strongzhen.com
gaikokujin-jinzai.com
runtu.ltd
cruisia.com
violaperitivo.com
amulyakandikonda.com
shorelaketampa.com
evyandella.com
robertodammora.info
micro-fut.com
caminhosdoacre.com
mikifamily.com
wellsassistancefargoalert.com
coyo.ltd
aldeiaterra.com
wishfuldreamnewportnews.com
maker-cnc.com
ruralvia2acceso.net
freetraffic2updatesall.win
pub-sora.com
vizcaps.com
yychsm.com
ayudameperu.com
smyeocut.win

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/360-0-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral2/memory/360-1-0x000000000041B6D0-mapping.dmp	formbook
behavioral2/memory/3960-2-0x0000000000000000-mapping.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SWIFT COPY.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SWIFT COPY.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SWIFT COPY.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	SWIFT COPY.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 360	1304	SWIFT COPY.exe	79
PID 360 set thread context of 2352	360	SWIFT COPY.exe	57
PID 3960 set thread context of 2352	3960	cscript.exe	57

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
360	SWIFT COPY.exe
360	SWIFT COPY.exe
360	SWIFT COPY.exe
360	SWIFT COPY.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe
3960	cscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
360	SWIFT COPY.exe
360	SWIFT COPY.exe
360	SWIFT COPY.exe
3960	cscript.exe
3960	cscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	360	SWIFT COPY.exe
Token: SeDebugPrivilege	3960	cscript.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2352	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 360	1304	SWIFT COPY.exe	79
PID 1304 wrote to memory of 360	1304	SWIFT COPY.exe	79
PID 1304 wrote to memory of 360	1304	SWIFT COPY.exe	79
PID 1304 wrote to memory of 360	1304	SWIFT COPY.exe	79
PID 1304 wrote to memory of 360	1304	SWIFT COPY.exe	79
PID 1304 wrote to memory of 360	1304	SWIFT COPY.exe	79
PID 2352 wrote to memory of 3960	2352	Explorer.EXE	86
PID 2352 wrote to memory of 3960	2352	Explorer.EXE	86
PID 2352 wrote to memory of 3960	2352	Explorer.EXE	86
PID 3960 wrote to memory of 4036	3960	cscript.exe	87
PID 3960 wrote to memory of 4036	3960	cscript.exe	87
PID 3960 wrote to memory of 4036	3960	cscript.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe"
  2⤵
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:360
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2096
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1768
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:564
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1568
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:3976
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4028
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe"
    3⤵
    PID:4036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3960-3-0x0000000000F70000-0x0000000000F97000-memory.dmp

Download

memory/3960-4-0x0000000000F70000-0x0000000000F97000-memory.dmp

Download

memory/3960-6-0x00000000057C0000-0x0000000005935000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads