formbook | 85774cdd3163c5e259dafdf67b113fd69fa8f4f9ebd964ee91b099bd2f58ebfd

General

Target
SWIFT DOZNAKA.exe
Size 655KB
Sample201109-xtvy4ev3ga
SHA256 85774cdd3163c5e259dafdf67b113fd69fa8f4f9ebd964ee91b099bd2f58ebfd
MD5 af3108b6d0e79e10bbe7d41569329242
SHA1 f0664a4be7c9b187f441912c342466d1f1952b84
SHA512 7f62d22804daf98e2ccc7176834f089aafca465e7f971eb9f64720003c57dc7888eddb709bfd4858ced5ab6261a220d610c47e0a6a31c2f296adb32ad5bc8180
MD5 SHA1 SHA512

Score

10^/10

formbook persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.joomlas123.info/n7ak/

Decoy

audereventur.com
huro14.com
wwwjinsha155.com
antiquevendor.com
samuraisoulfood.net
traffic4updates.download
hypersarv.com
rapport-happy-wedding.com
rokutechnosupport.online
allworljob.com
hanaleedossmann.com
kauai-marathon.com
bepbosch.com
kangen-international.com
zoneshopemenowz.com
belviderewrestling.com
ipllink.com
sellingforcreators.com
wwwswty6655.com
qtumboa.com
bazarmoney.net
librosdecienciaficcion.com
shopmomsthebomb.com
vanjacob.com
tgyaa.com
theporncollective.net
hydrabadproperties.com
brindesecologicos.com
sayagayrimenkul.net
4btoken.com
shycedu.com
overall789.top
maison-pierre-bayle.com
elitemediamasters.com
sharmasfabrics.com
hoshamp.com
myultimateleadgenerator.com
office4u.info
thaimart1.com
ultimatewindowusa.com
twoblazesartworks.com
airteloffer.com
shoupaizhao.com
741dakotadr.info
books4arab.net
artedelcioccolato.biz
tjqcu.info
teccoop.net
maturebridesdressguide.com
excelcapfunding.com
bitcoinak.com
profileorderflow.com
unbelievabowboutique.com
midlandshomesolutionsltd.com
healthywithhook.com
stirlingpiper.com
manfast.online
arikorin.com
texastrustedinsurance.com
moodandmystery.com
yh77808.com
s-immotanger.com
runzexd.com
meteoannecy.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1080-1-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1080-2-0x000000000041E380-mapping.dmp	formbook
behavioral1/memory/1836-3-0x0000000000000000-mapping.dmp	formbook

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LPXPD = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe"	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1080 set thread context of 1272	1080	ieinstal.exe	21
PID 1836 set thread context of 1272	1836	rundll32.exe	21

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	rundll32.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1080	ieinstal.exe
1080	ieinstal.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1080	ieinstal.exe
1080	ieinstal.exe
1080	ieinstal.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	ieinstal.exe
Token: SeDebugPrivilege	1836	rundll32.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1852 wrote to memory of 1080	1852	SWIFT DOZNAKA.exe	31
PID 1272 wrote to memory of 1836	1272	Explorer.EXE	32
PID 1272 wrote to memory of 1836	1272	Explorer.EXE	32
PID 1272 wrote to memory of 1836	1272	Explorer.EXE	32
PID 1272 wrote to memory of 1836	1272	Explorer.EXE	32
PID 1272 wrote to memory of 1836	1272	Explorer.EXE	32
PID 1272 wrote to memory of 1836	1272	Explorer.EXE	32
PID 1272 wrote to memory of 1836	1272	Explorer.EXE	32
PID 1836 wrote to memory of 1336	1836	rundll32.exe	33
PID 1836 wrote to memory of 1336	1836	rundll32.exe	33
PID 1836 wrote to memory of 1336	1836	rundll32.exe	33
PID 1836 wrote to memory of 1336	1836	rundll32.exe	33
PID 1836 wrote to memory of 1336	1836	rundll32.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\SWIFT DOZNAKA.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT DOZNAKA.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Program Files (x86)\internet explorer\ieinstal.exe
    "C:\Program Files (x86)\internet explorer\ieinstal.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1336