formbook | 55e40397f7933e9ae3826ebb13481d4f91f31dd7c8e4de461f5f90679c05ffc6

General

Target

LOI.exe
Size

730KB
MD5

17069e546f158a94eebb67883783f236
SHA1

78bf28fc9cfc94fa4b0232d25b3eeebcc1d823e2
SHA256

55e40397f7933e9ae3826ebb13481d4f91f31dd7c8e4de461f5f90679c05ffc6
SHA512

5ae9a6ff39d634c28750a6dea20956dadb29aac92621ac16fb7800fded33de1202ea0e82bd187da0eff2cbbdba7039f821a196e7c0b367aeeb5e18b3ba9f788d

Score

10^/10

formbook evasion rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.myoasisforhealing.com/zu8g/

Decoy

teamhumanity2020.com

nestennhome.com

suamaylanhmiennam.com

antigermpros.com

lisatfashions.com

5509bet04.com

vpncreate.com

rangers3.xyz

kotaskeyschains.com

manatapmasalalu.com

mordo.asia

ranelpadon.com

tisnmao.com

eatsourdough.com

spreadthelovestophate.com

superiorvillage.com

ecualeaf.com

tribelogy.net

kaway.online

xp055.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3008-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3008-14-0x000000000041ED20-mapping.dmp	formbook
behavioral2/memory/2136-21-0x0000000000B30000-0x0000000000B5E000-memory.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LOI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LOI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LOI.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

LOI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	LOI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	LOI.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

LOI.exeLOI.exeNETSTAT.EXE

description	pid	process	target process
PID 648 set thread context of 3008	648	LOI.exe	LOI.exe
PID 3008 set thread context of 3040	3008	LOI.exe	Explorer.EXE
PID 2136 set thread context of 3040	2136	NETSTAT.EXE	Explorer.EXE

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

NETSTAT.EXE

pid process

2136 NETSTAT.EXE

pid	process
2136	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

LOI.exeNETSTAT.EXE

pid	process
3008	LOI.exe
3008	LOI.exe
3008	LOI.exe
3008	LOI.exe
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE
2136	NETSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

LOI.exeNETSTAT.EXE

pid process

3008 LOI.exe
3008 LOI.exe
3008 LOI.exe
2136 NETSTAT.EXE
2136 NETSTAT.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

LOI.exeNETSTAT.EXE

description pid process

Token: SeDebugPrivilege 3008 LOI.exe
Token: SeDebugPrivilege 2136 NETSTAT.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3040 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3008	LOI.exe
Token: SeDebugPrivilege	2136	NETSTAT.EXE

pid	process
3040	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

LOI.exeExplorer.EXENETSTAT.EXE

description	pid	process	target process
PID 648 wrote to memory of 3008	648	LOI.exe	LOI.exe
PID 648 wrote to memory of 3008	648	LOI.exe	LOI.exe
PID 648 wrote to memory of 3008	648	LOI.exe	LOI.exe
PID 648 wrote to memory of 3008	648	LOI.exe	LOI.exe
PID 648 wrote to memory of 3008	648	LOI.exe	LOI.exe
PID 648 wrote to memory of 3008	648	LOI.exe	LOI.exe
PID 3040 wrote to memory of 2136	3040	Explorer.EXE	NETSTAT.EXE
PID 3040 wrote to memory of 2136	3040	Explorer.EXE	NETSTAT.EXE
PID 3040 wrote to memory of 2136	3040	Explorer.EXE	NETSTAT.EXE
PID 2136 wrote to memory of 3860	2136	NETSTAT.EXE	cmd.exe
PID 2136 wrote to memory of 3860	2136	NETSTAT.EXE	cmd.exe
PID 2136 wrote to memory of 3860	2136	NETSTAT.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\LOI.exe
"C:\Users\Admin\AppData\Local\Temp\LOI.exe"
2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\LOI.exe
"C:\Users\Admin\AppData\Local\Temp\LOI.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\LOI.exe"
3⤵
PID:3860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-2-0x0000000073190000-0x000000007387E000-memory.dmp

Filesize
6.9MB

Download
memory/648-3-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/648-5-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/648-6-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/648-7-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/648-8-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/648-9-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/648-10-0x0000000004D90000-0x0000000004DB3000-memory.dmp

Filesize
140KB

Download
memory/648-11-0x00000000058A0000-0x0000000005906000-memory.dmp

Filesize
408KB

Download
memory/648-12-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2136-19-0x0000000000000000-mapping.dmp

Download
memory/2136-21-0x0000000000B30000-0x0000000000B5E000-memory.dmp

Filesize
184KB

Download
memory/2136-20-0x0000000000FB0000-0x0000000000FBB000-memory.dmp

Filesize
44KB

Download
memory/2136-22-0x0000000003520000-0x0000000003840000-memory.dmp

Filesize
3.1MB

Download
memory/2136-24-0x0000000003440000-0x00000000034D3000-memory.dmp

Filesize
588KB

Download
memory/3008-14-0x000000000041ED20-mapping.dmp

Download
memory/3008-17-0x00000000016E0000-0x00000000016F4000-memory.dmp

Filesize
80KB

Download
memory/3008-16-0x0000000001740000-0x0000000001A60000-memory.dmp

Filesize
3.1MB

Download
memory/3008-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3040-18-0x00000000032C0000-0x0000000003371000-memory.dmp

Filesize
708KB

Download
memory/3040-25-0x0000000001480000-0x0000000001547000-memory.dmp

Filesize
796KB

Download
memory/3860-23-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads