formbook | 2664162d0341d8e5cf1cf3a290b77406d87111e3c9ff3fcf3a4f0836d15d3afe

General

Target
VOMAXTRADING.doc
Size 1.6MB
Sample201126-7ym4vd7kvs
SHA256 2664162d0341d8e5cf1cf3a290b77406d87111e3c9ff3fcf3a4f0836d15d3afe
MD5 30244581b41accd77dab936571e0d87e
SHA1 46ddb3fa250dfb4808c3a43f7846d7c643a4f325
SHA512 485074c33256cd04b80f1f58297f5d26f55be56cd8837d35a825d8612407b310bfa29cde9e1934eec92da0a77b37f6e21f0ced9e3ce731ed8673c4b4da82f00e
MD5 SHA1 SHA512

Score

10^/10

formbook persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.runwithit.media/bu43/

Decoy

bearrootstherapy.com
odmpay.com
johnfornmgov.com
astrodhaam.com
pumavps.com
empireconstructiontx.com
theboujeestop.com
indictthem.com
plantationbarnof1810.com
nsxs.xyz
lgshowroom.com
allinlifestyle.club
ik-com.net
saitamacity-sports.com
neuromuscularmassagetherapy.com
freespiritnutrition.com
alexanderhamilton.computer
happysay.co.uk
nndesignpr.com
lightweightmouldings.com
sparkassen-oekosystem.finance
majestikflix.com
xbox360vpn.com
rivareservadapraca.com
waldherr.one
soluzionigare.com
personalizedsportsz.com
mycapecrusade.com
escrapedia.com
defineliberal.net
xn--54qt7bmzf8pw82mnmogwd.com
cookies-x.info
38buu.com
nirv.tech
isabellelodo.com
myquickmedia.com
luxuryevim.net
kimmycakesmore.com
akasyaofistasima.com
markhatesfreedom.com
stock-ology.com
opel-occasions-ales.com
lunajurado.com
musmarservices.com
editionsfeuvert.com
mizusukenikko.com
coaching-dreams.com
bentleyandraesdecorandmore.com
mr-mrsramirez.com
junarmusic.com
jesed72.com
serviceelectriccablevision1.com
e-capakistan.com
thedentalplanner.com
mohasaffron.com
tciclinics.info
rockinrranchpuntademita.com
gubbelspaprika.com
citizenspride.com
compprogedu.com
prierejanaza.com
toyotamotor360.com
academiadosaberdagrios.com
burakcelikkapi.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1440-1087-0x0000000000400000-0x0000000000429000-memory.dmp	formbook
behavioral1/memory/1440-1088-0x000000000041D0B0-mapping.dmp	formbook
behavioral1/memory/1068-1091-0x0000000000000000-mapping.dmp	formbook

Blacklisted process makes network request 1 IoCs

flow	pid	Process
6	2000	EQNEDT32.EXE

Executes dropped EXE 2 IoCs

pid	Process
1124	skypound83892.exe
1440	skypound83892.exe

Loads dropped DLL 1 IoCs

pid	Process
2000	EQNEDT32.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Firefoxe\\firefos.exe\""	skypound83892.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 1440	1124	skypound83892.exe	35
PID 1440 set thread context of 1248	1440	skypound83892.exe	21
PID 1440 set thread context of 1248	1440	skypound83892.exe	21
PID 1068 set thread context of 1248	1068	systray.exe	21

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
2000	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1700	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1440	skypound83892.exe
1440	skypound83892.exe
1440	skypound83892.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe
1068	systray.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1440	skypound83892.exe
1440	skypound83892.exe
1440	skypound83892.exe
1440	skypound83892.exe
1068	systray.exe
1068	systray.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	skypound83892.exe
Token: SeDebugPrivilege	1440	skypound83892.exe
Token: SeDebugPrivilege	1068	systray.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1700	WINWORD.EXE
1700	WINWORD.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1124	2000	EQNEDT32.EXE	32
PID 2000 wrote to memory of 1124	2000	EQNEDT32.EXE	32
PID 2000 wrote to memory of 1124	2000	EQNEDT32.EXE	32
PID 2000 wrote to memory of 1124	2000	EQNEDT32.EXE	32
PID 1124 wrote to memory of 1440	1124	skypound83892.exe	35
PID 1124 wrote to memory of 1440	1124	skypound83892.exe	35
PID 1124 wrote to memory of 1440	1124	skypound83892.exe	35
PID 1124 wrote to memory of 1440	1124	skypound83892.exe	35
PID 1124 wrote to memory of 1440	1124	skypound83892.exe	35
PID 1124 wrote to memory of 1440	1124	skypound83892.exe	35
PID 1124 wrote to memory of 1440	1124	skypound83892.exe	35
PID 1440 wrote to memory of 1068	1440	skypound83892.exe	36
PID 1440 wrote to memory of 1068	1440	skypound83892.exe	36
PID 1440 wrote to memory of 1068	1440	skypound83892.exe	36
PID 1440 wrote to memory of 1068	1440	skypound83892.exe	36
PID 1068 wrote to memory of 2036	1068	systray.exe	37
PID 1068 wrote to memory of 2036	1068	systray.exe	37
PID 1068 wrote to memory of 2036	1068	systray.exe	37
PID 1068 wrote to memory of 2036	1068	systray.exe	37

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1248
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\VOMAXTRADING.doc"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1700

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Roaming\skypound83892.exe
  "C:\Users\Admin\AppData\Roaming\skypound83892.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\AppData\Roaming\skypound83892.exe
    "C:\Users\Admin\AppData\Roaming\skypound83892.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Roaming\skypound83892.exe"
        5⤵
        
        PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-1-0x000007FEF7D90000-0x000007FEF800A000-memory.dmp

Download

memory/1068-1094-0x0000000004110000-0x000000000427E000-memory.dmp

Download

memory/1068-1092-0x0000000000180000-0x0000000000185000-memory.dmp

Download

memory/1124-6-0x000000006BA70000-0x000000006C15E000-memory.dmp

Download

memory/1124-7-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/1124-9-0x00000000046A0000-0x00000000046FB000-memory.dmp

Download

memory/1124-1086-0x0000000022360000-0x0000000022376000-memory.dmp

Download

memory/1248-1090-0x0000000006C50000-0x0000000006D65000-memory.dmp

Download

memory/1248-1095-0x0000000003CB0000-0x0000000003D5D000-memory.dmp

Download

memory/1440-1087-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1700-0-0x0000000003F10000-0x0000000003F14000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads