formbook | c06d84a04de7e2e2300b5a5de7e531d26e67e2f7bcaf29c34b9f15dada38f502

General

Target

a1775a2476e688c996883a990c5d2447.exe
Size

508KB
MD5

a1775a2476e688c996883a990c5d2447
SHA1

44f49ab707ef24b3b24c9b17da1dae2ccf7faa67
SHA256

c06d84a04de7e2e2300b5a5de7e531d26e67e2f7bcaf29c34b9f15dada38f502
SHA512

a4a426591faf22232b59837d53d02f9adf1ff84babee469a7a3ce831fcaccf9dd1996a3715e160495309791ef53c0e5b3424646a019895fa44eff26a8084cb46

Score

10^/10

formbook modiloader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

C2

http://www.mansiobbok.info/i19/

Decoy

carolinahempandhops.com

produkdigitalstore.com

fortmargins.com

freemycall.com

duan-sceniabaynhatrang.com

aymarka.site

americanstanardtubs.com

noritzas.com

plasticprintingservices.com

nb-junhong.com

joindanbrown.com

yy319.com

techjobschicago.com

soldamed.com

rybctushu.com

139139062.com

casasychaletspamplona.com

grupohman.com

letsomelightin.com

inspiredinteriorsco.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1348-120-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a1775a2476e688c996883a990c5d2447.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sazb = "C:\\Users\\Admin\\Sazb\\Sazb.hta"	a1775a2476e688c996883a990c5d2447.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

a1775a2476e688c996883a990c5d2447.exe

description pid process target process

PID 424 set thread context of 1348 424 a1775a2476e688c996883a990c5d2447.exe ieinstal.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

492 1348 WerFault.exe ieinstal.exe

description	pid	process	target process
PID 424 set thread context of 1348	424	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe

pid	pid_target	process	target process
492	1348	WerFault.exe	ieinstal.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

a1775a2476e688c996883a990c5d2447.exeWerFault.exe

pid	process
424	a1775a2476e688c996883a990c5d2447.exe
424	a1775a2476e688c996883a990c5d2447.exe
424	a1775a2476e688c996883a990c5d2447.exe
424	a1775a2476e688c996883a990c5d2447.exe
424	a1775a2476e688c996883a990c5d2447.exe
424	a1775a2476e688c996883a990c5d2447.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 492 WerFault.exe
Token: SeBackupPrivilege 492 WerFault.exe
Token: SeDebugPrivilege 492 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	492	WerFault.exe
Token: SeBackupPrivilege	492	WerFault.exe
Token: SeDebugPrivilege	492	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a1775a2476e688c996883a990c5d2447.exe

description	pid	process	target process
PID 424 wrote to memory of 1348	424	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 424 wrote to memory of 1348	424	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 424 wrote to memory of 1348	424	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 424 wrote to memory of 1348	424	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe
PID 424 wrote to memory of 1348	424	a1775a2476e688c996883a990c5d2447.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\a1775a2476e688c996883a990c5d2447.exe
"C:\Users\Admin\AppData\Local\Temp\a1775a2476e688c996883a990c5d2447.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:424

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 200
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-114-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1348-115-0x0000000000530000-0x000000000055F000-memory.dmp

Filesize
188KB

Download
memory/1348-116-0x00000000005315C0-mapping.dmp

Download
memory/1348-120-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1348-119-0x0000000000530000-0x000000000055F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads