formbook | 4f11e57e682eba91e574e673edce45efab46c20ad2d98826fb1b0880adee2aa0

General

Target
POgMmI.exe
Size 1.3MB
Sample201217-nynryghnwe
SHA256 4f11e57e682eba91e574e673edce45efab46c20ad2d98826fb1b0880adee2aa0
MD5 8415b1d35c8dad9cf2630d7a4a9c8107
SHA1 6ce3a8619d93859b173cfb7c2d52d45601df12c1
SHA512 98f37a401255310311a83d3a2b7e12b991458fb73a8b80404d168ac5dec07f50c8fda92afcc65f091b6b821f50f41995bec2a51eb7974f33592afb033e03af65
MD5 SHA1 SHA512

Score

10^/10

formbook evasion rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bestylishstore.com/wsu/

Decoy

anticoronapreventionshop.com
zabaera.com
13shares.com
doudoutrip.com
fabdivanails.com
4525wichita.com
victoriabroadcast.com
syfxzs.com
cqyzhs.com
yesamper.com
nnqglqwl.com
dontbringithome.com
fakekiwi.com
sellmyhousecashnyc.com
wordshirts.store
geezerbible.com
admibd.com
acid-gaming.net
originalproductsbotanica.com
frenchracing.club
ikigai729.com
godtried.com
nutshop-cihangir.com
parabaldu.com
kulsumworld.com
vndstore.com
alwaysfreshmatters.com
doublelblonghorns.com
needscheck.com
melanindiamondsllc.com
sdyjpj.com
dwgjhy.com
pastepool.com
softdevteams.com
tageslinsen.info
drive-true.com
paper2airplane.com
surptalb.xyz
smxlyhq.com
anders2meesterschilder.com
780martelo.com
welcomeawake.com
earn046.com
duplicuty-garden.com
cgjazkgn.icu
wonderlandunited.com
tom-kiesel.com
landeverrealestate.com
856380167.xyz
axombozar.com
ten21agency.com
www-commercieelreader.info
chicofreeclothing.com
littlecacti.com
immunotravels.com
spreadpod.com
selah-speaks.com
grupo-onic.com
figuratus.com
internet-fptbacninh.com
beautiflymoneymaker.com
truckersnavkits.com
educationbeo.com
xn--segurodeautomvel-ivb.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1520-11-0x000000000041EB40-mapping.dmp	formbook
behavioral1/memory/1520-10-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1356-12-0x0000000000000000-mapping.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	POgMmI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	POgMmI.exe

Deletes itself 1 IoCs

pid	Process
1616	cmd.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	POgMmI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	POgMmI.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 1520	1204	POgMmI.exe	30
PID 1520 set thread context of 1220	1520	POgMmI.exe	11
PID 1356 set thread context of 1220	1356	wuapp.exe	11

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1520	POgMmI.exe
1520	POgMmI.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe
1356	wuapp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1520	POgMmI.exe
1520	POgMmI.exe
1520	POgMmI.exe
1356	wuapp.exe
1356	wuapp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	POgMmI.exe
Token: SeDebugPrivilege	1356	wuapp.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1520	1204	POgMmI.exe	30
PID 1204 wrote to memory of 1520	1204	POgMmI.exe	30
PID 1204 wrote to memory of 1520	1204	POgMmI.exe	30
PID 1204 wrote to memory of 1520	1204	POgMmI.exe	30
PID 1204 wrote to memory of 1520	1204	POgMmI.exe	30
PID 1204 wrote to memory of 1520	1204	POgMmI.exe	30
PID 1204 wrote to memory of 1520	1204	POgMmI.exe	30
PID 1220 wrote to memory of 1356	1220	Explorer.EXE	32
PID 1220 wrote to memory of 1356	1220	Explorer.EXE	32
PID 1220 wrote to memory of 1356	1220	Explorer.EXE	32
PID 1220 wrote to memory of 1356	1220	Explorer.EXE	32
PID 1220 wrote to memory of 1356	1220	Explorer.EXE	32
PID 1220 wrote to memory of 1356	1220	Explorer.EXE	32
PID 1220 wrote to memory of 1356	1220	Explorer.EXE	32
PID 1356 wrote to memory of 1616	1356	wuapp.exe	33
PID 1356 wrote to memory of 1616	1356	wuapp.exe	33
PID 1356 wrote to memory of 1616	1356	wuapp.exe	33
PID 1356 wrote to memory of 1616	1356	wuapp.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\POgMmI.exe
  "C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"
  2⤵
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Users\Admin\AppData\Local\Temp\POgMmI.exe
    "C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:968
- C:\Windows\SysWOW64\wuapp.exe
  "C:\Windows\SysWOW64\wuapp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"
    3⤵
    - Deletes itself
    PID:1616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-2-0x00000000740B0000-0x000000007479E000-memory.dmp

Download

memory/1204-3-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/1204-5-0x00000000004E0000-0x00000000004F2000-memory.dmp

Download

memory/1204-6-0x00000000051E0000-0x000000000528D000-memory.dmp

Download

memory/1204-7-0x0000000000670000-0x0000000000678000-memory.dmp

Download

memory/1204-9-0x00000000054E0000-0x000000000556F000-memory.dmp

Download

memory/1356-13-0x0000000000AE0000-0x0000000000AEB000-memory.dmp

Download

memory/1356-15-0x0000000003160000-0x000000000323C000-memory.dmp

Download

memory/1520-10-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads