formbook | c06d84a04de7e2e2300b5a5de7e531d26e67e2f7bcaf29c34b9f15dada38f502

General

Target

a1775a2476e688c996883a990c5d2447.exe
Size

508KB
MD5

a1775a2476e688c996883a990c5d2447
SHA1

44f49ab707ef24b3b24c9b17da1dae2ccf7faa67
SHA256

c06d84a04de7e2e2300b5a5de7e531d26e67e2f7bcaf29c34b9f15dada38f502
SHA512

a4a426591faf22232b59837d53d02f9adf1ff84babee469a7a3ce831fcaccf9dd1996a3715e160495309791ef53c0e5b3424646a019895fa44eff26a8084cb46

Score

10^/10

formbook modiloader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

C2

http://www.mansiobbok.info/i19/

Decoy

carolinahempandhops.com

produkdigitalstore.com

fortmargins.com

freemycall.com

duan-sceniabaynhatrang.com

aymarka.site

americanstanardtubs.com

noritzas.com

plasticprintingservices.com

nb-junhong.com

joindanbrown.com

yy319.com

techjobschicago.com

soldamed.com

rybctushu.com

139139062.com

casasychaletspamplona.com

grupohman.com

letsomelightin.com

inspiredinteriorsco.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/576-67-0x0000000000100000-0x000000000012A000-memory.dmp	formbook

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a1775a2476e688c996883a990c5d2447.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sazb = "C:\\Users\\Admin\\Sazb\\Sazb.hta"	a1775a2476e688c996883a990c5d2447.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

a1775a2476e688c996883a990c5d2447.exe

description pid process target process

PID 1640 set thread context of 576 1640 a1775a2476e688c996883a990c5d2447.exe ieinstal.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

668 576 WerFault.exe ieinstal.exe

description	pid	process	target process
PID 1640 set thread context of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe

pid	pid_target	process	target process
668	576	WerFault.exe	ieinstal.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a1775a2476e688c996883a990c5d2447.exeWerFault.exe

pid	process
1640	a1775a2476e688c996883a990c5d2447.exe
1640	a1775a2476e688c996883a990c5d2447.exe
1640	a1775a2476e688c996883a990c5d2447.exe
668	WerFault.exe
668	WerFault.exe
668	WerFault.exe
668	WerFault.exe
668	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

668 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 668 WerFault.exe

pid	process
668	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	668	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

a1775a2476e688c996883a990c5d2447.exeieinstal.exe

description	pid	process	target process
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 1640 wrote to memory of 576	1640	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 576 wrote to memory of 668	576	ieinstal.exe	WerFault.exe
PID 576 wrote to memory of 668	576	ieinstal.exe	WerFault.exe
PID 576 wrote to memory of 668	576	ieinstal.exe	WerFault.exe
PID 576 wrote to memory of 668	576	ieinstal.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a1775a2476e688c996883a990c5d2447.exe
"C:\Users\Admin\AppData\Local\Temp\a1775a2476e688c996883a990c5d2447.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 40
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-63-0x00000000005315C0-mapping.dmp

Download
memory/576-62-0x0000000000530000-0x000000000055F000-memory.dmp

Filesize
188KB

Download
memory/576-66-0x0000000000530000-0x000000000055F000-memory.dmp

Filesize
188KB

Download
memory/576-67-0x0000000000100000-0x000000000012A000-memory.dmp

Filesize
168KB

Download
memory/668-64-0x0000000000000000-mapping.dmp

Download
memory/668-68-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1640-60-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1640-61-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads