formbook | e2cc8c23ff3dc0294b72571080f92677314d758c5248ef77a839e1b62818df42

General

Target

LOI.exe
Size

809KB
MD5

f55d280858080efac6e84da67a284d75
SHA1

816c8aea265cc8084bb5d9a5ad954eb295178524
SHA256

e2cc8c23ff3dc0294b72571080f92677314d758c5248ef77a839e1b62818df42
SHA512

72b01d2003c2aeaa90793d42d23922c6a6bbca5bd8c2abec10c114c419fd0a30b314c2491f9219ee29e266c2b0707089dcba514e7acd0a5df01de0275fbeddb5

Score

10^/10

formbook evasion rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.fenhouses.com/nhk9/

Decoy

livinginroanokeva.com

entpiregaming.com

solutionsolvegh.com

glasgowcmr.com

gutesbenehmen.com

gracecitychurchmadison.com

linkalto.com

waahingtontimes.com

hxcked.com

buyung.xyz

asesormarketing.digital

bolodl.com

blushnbella.com

overhalldiesel.com

loveyorkshirecoast.com

puffpornandpizza.com

virgilisticlifestyleinc.com

clingnseal.com

artisantop.com

webinarsusa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/416-9-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/416-10-0x000000000041ED70-mapping.dmp	formbook
behavioral1/memory/528-12-0x0000000000000000-mapping.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LOI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LOI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LOI.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1620 cmd.exe

pid	process
1620	cmd.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

LOI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	LOI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	LOI.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

LOI.exeLOI.exemsdt.exe

description	pid	process	target process
PID 868 set thread context of 416	868	LOI.exe	LOI.exe
PID 416 set thread context of 1200	416	LOI.exe	Explorer.EXE
PID 416 set thread context of 1200	416	LOI.exe	Explorer.EXE
PID 528 set thread context of 1200	528	msdt.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1576 schtasks.exe

pid	process
1576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

LOI.exemsdt.exe

pid	process
416	LOI.exe
416	LOI.exe
416	LOI.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe
528	msdt.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

LOI.exemsdt.exe

pid process

416 LOI.exe
416 LOI.exe
416 LOI.exe
416 LOI.exe
528 msdt.exe
528 msdt.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

LOI.exemsdt.exe

description pid process

Token: SeDebugPrivilege 416 LOI.exe
Token: SeDebugPrivilege 528 msdt.exe

description	pid	process
Token: SeDebugPrivilege	416	LOI.exe
Token: SeDebugPrivilege	528	msdt.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

LOI.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 868 wrote to memory of 1576	868	LOI.exe	schtasks.exe
PID 868 wrote to memory of 1576	868	LOI.exe	schtasks.exe
PID 868 wrote to memory of 1576	868	LOI.exe	schtasks.exe
PID 868 wrote to memory of 1576	868	LOI.exe	schtasks.exe
PID 868 wrote to memory of 416	868	LOI.exe	LOI.exe
PID 868 wrote to memory of 416	868	LOI.exe	LOI.exe
PID 868 wrote to memory of 416	868	LOI.exe	LOI.exe
PID 868 wrote to memory of 416	868	LOI.exe	LOI.exe
PID 868 wrote to memory of 416	868	LOI.exe	LOI.exe
PID 868 wrote to memory of 416	868	LOI.exe	LOI.exe
PID 868 wrote to memory of 416	868	LOI.exe	LOI.exe
PID 1200 wrote to memory of 528	1200	Explorer.EXE	msdt.exe
PID 1200 wrote to memory of 528	1200	Explorer.EXE	msdt.exe
PID 1200 wrote to memory of 528	1200	Explorer.EXE	msdt.exe
PID 1200 wrote to memory of 528	1200	Explorer.EXE	msdt.exe
PID 528 wrote to memory of 1620	528	msdt.exe	cmd.exe
PID 528 wrote to memory of 1620	528	msdt.exe	cmd.exe
PID 528 wrote to memory of 1620	528	msdt.exe	cmd.exe
PID 528 wrote to memory of 1620	528	msdt.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\LOI.exe
  "C:\Users\Admin\AppData\Local\Temp\LOI.exe"
  2⤵
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CxzHEiq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2BD1.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\LOI.exe
    "C:\Users\Admin\AppData\Local\Temp\LOI.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\LOI.exe"
    3⤵
    - Deletes itself
    PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2BD1.tmp

MD5
9bf5ad85ef53d8167ffaa5e728094a00

SHA1
045696e8e8de097bf5af6038cda699d4e0f1cc04

SHA256
603dd00ff8660545491245ffc4958f7a6a1bd4ae0318005d378859cd3647b145

SHA512
dcb2d636239e43de0de2fab6a07fffddefcc7e21043585457c8990523ece0f2c3d8b83c4386eceb903833f07d3695776de05ce9ce9306b4d8047fff3ad6e4341

Download Submit
memory/416-10-0x000000000041ED70-mapping.dmp

Download
memory/416-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/528-12-0x0000000000000000-mapping.dmp

Download
memory/528-13-0x0000000000080000-0x0000000000174000-memory.dmp

Filesize
976KB

Download
memory/528-15-0x0000000003330000-0x0000000003426000-memory.dmp

Filesize
984KB

Download
memory/868-6-0x0000000004FD0000-0x000000000503E000-memory.dmp

Filesize
440KB

Download
memory/868-5-0x0000000000490000-0x00000000004A2000-memory.dmp

Filesize
72KB

Download
memory/868-3-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/868-2-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/1200-11-0x0000000004ED0000-0x000000000504E000-memory.dmp

Filesize
1.5MB

Download
memory/1576-7-0x0000000000000000-mapping.dmp

Download
memory/1620-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads