formbook | 55e40397f7933e9ae3826ebb13481d4f91f31dd7c8e4de461f5f90679c05ffc6

General

Target

LOI.exe
Size

730KB
MD5

17069e546f158a94eebb67883783f236
SHA1

78bf28fc9cfc94fa4b0232d25b3eeebcc1d823e2
SHA256

55e40397f7933e9ae3826ebb13481d4f91f31dd7c8e4de461f5f90679c05ffc6
SHA512

5ae9a6ff39d634c28750a6dea20956dadb29aac92621ac16fb7800fded33de1202ea0e82bd187da0eff2cbbdba7039f821a196e7c0b367aeeb5e18b3ba9f788d

Score

10^/10

formbook evasion rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.myoasisforhealing.com/zu8g/

Decoy

teamhumanity2020.com

nestennhome.com

suamaylanhmiennam.com

antigermpros.com

lisatfashions.com

5509bet04.com

vpncreate.com

rangers3.xyz

kotaskeyschains.com

manatapmasalalu.com

mordo.asia

ranelpadon.com

tisnmao.com

eatsourdough.com

spreadthelovestophate.com

superiorvillage.com

ecualeaf.com

tribelogy.net

kaway.online

xp055.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/620-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/620-14-0x000000000041ED20-mapping.dmp	formbook
behavioral2/memory/1516-21-0x0000000000BD0000-0x0000000000BFE000-memory.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LOI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LOI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LOI.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

LOI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	LOI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	LOI.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

LOI.exeLOI.exewlanext.exe

description	pid	process	target process
PID 812 set thread context of 620	812	LOI.exe	LOI.exe
PID 620 set thread context of 3048	620	LOI.exe	Explorer.EXE
PID 1516 set thread context of 3048	1516	wlanext.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

LOI.exeLOI.exewlanext.exe

pid	process
812	LOI.exe
812	LOI.exe
620	LOI.exe
620	LOI.exe
620	LOI.exe
620	LOI.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe
1516	wlanext.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

LOI.exewlanext.exe

pid process

620 LOI.exe
620 LOI.exe
620 LOI.exe
1516 wlanext.exe
1516 wlanext.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

LOI.exeLOI.exewlanext.exe

description pid process

Token: SeDebugPrivilege 812 LOI.exe
Token: SeDebugPrivilege 620 LOI.exe
Token: SeDebugPrivilege 1516 wlanext.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3048 Explorer.EXE

pid	process
620	LOI.exe
620	LOI.exe
620	LOI.exe
1516	wlanext.exe
1516	wlanext.exe

description	pid	process
Token: SeDebugPrivilege	812	LOI.exe
Token: SeDebugPrivilege	620	LOI.exe
Token: SeDebugPrivilege	1516	wlanext.exe

pid	process
3048	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

LOI.exeExplorer.EXEwlanext.exe

description	pid	process	target process
PID 812 wrote to memory of 508	812	LOI.exe	LOI.exe
PID 812 wrote to memory of 508	812	LOI.exe	LOI.exe
PID 812 wrote to memory of 508	812	LOI.exe	LOI.exe
PID 812 wrote to memory of 620	812	LOI.exe	LOI.exe
PID 812 wrote to memory of 620	812	LOI.exe	LOI.exe
PID 812 wrote to memory of 620	812	LOI.exe	LOI.exe
PID 812 wrote to memory of 620	812	LOI.exe	LOI.exe
PID 812 wrote to memory of 620	812	LOI.exe	LOI.exe
PID 812 wrote to memory of 620	812	LOI.exe	LOI.exe
PID 3048 wrote to memory of 1516	3048	Explorer.EXE	wlanext.exe
PID 3048 wrote to memory of 1516	3048	Explorer.EXE	wlanext.exe
PID 3048 wrote to memory of 1516	3048	Explorer.EXE	wlanext.exe
PID 1516 wrote to memory of 4024	1516	wlanext.exe	cmd.exe
PID 1516 wrote to memory of 4024	1516	wlanext.exe	cmd.exe
PID 1516 wrote to memory of 4024	1516	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\LOI.exe
"C:\Users\Admin\AppData\Local\Temp\LOI.exe"
2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Local\Temp\LOI.exe
"C:\Users\Admin\AppData\Local\Temp\LOI.exe"
3⤵
PID:508

C:\Users\Admin\AppData\Local\Temp\LOI.exe
"C:\Users\Admin\AppData\Local\Temp\LOI.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\LOI.exe"
3⤵
PID:4024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

2

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/620-17-0x0000000001AC0000-0x0000000001AD4000-memory.dmp

Filesize
80KB

Download
memory/620-16-0x0000000001610000-0x0000000001930000-memory.dmp

Filesize
3.1MB

Download
memory/620-14-0x000000000041ED20-mapping.dmp

Download
memory/812-8-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/812-3-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/812-9-0x0000000004F50000-0x0000000004F73000-memory.dmp

Filesize
140KB

Download
memory/812-10-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/812-11-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/812-12-0x0000000005B90000-0x0000000005B91000-memory.dmp

Filesize
4KB

Download
memory/812-7-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/812-6-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/812-5-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/812-2-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/1516-19-0x0000000000000000-mapping.dmp

Download
memory/1516-21-0x0000000000BD0000-0x0000000000BFE000-memory.dmp

Filesize
184KB

Download
memory/1516-20-0x0000000000E70000-0x0000000000E87000-memory.dmp

Filesize
92KB

Download
memory/1516-23-0x0000000002F10000-0x0000000003230000-memory.dmp

Filesize
3.1MB

Download
memory/1516-24-0x0000000003350000-0x00000000033E3000-memory.dmp

Filesize
588KB

Download
memory/3048-18-0x0000000005960000-0x0000000005AA6000-memory.dmp

Filesize
1.3MB

Download
memory/3048-25-0x0000000002560000-0x000000000260A000-memory.dmp

Filesize
680KB

Download
memory/4024-22-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads