formbook | d1b0b995cd714c9eb3f896879019bbea31f78e4ade3193e2222d38984926d267

General

Target

COMPANY PROFILE_pdf.exe
Size

613KB
MD5

b9944266973f87de2c403a192ea512e9
SHA1

dad5d6c849383cd568d409a3898d8a5f6f965838
SHA256

481276a9bb55fca18c31952e4746dd5b480442e079dbf660318f780c22a9cf4d
SHA512

2343b49478474f2d5d0855eee6ecade5b227bf8f77831bcf24cdcb71181bbd5451344e09a0048dc4178cbb9511141c18bf6943b02f00a39efd6488978e1e5622

Score

10^/10

formbook jb9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

jb9

Decoy

cloud-medical.com

maximtech-bd.com

3d-sprint.com

624vhw.info

nexdesk.net

flxcustomsigns.com

gvuzejobxa.info

xiaobaokm.com

565mt.com

servicioscuery.com

500360.biz

stephanieshermanart.com

boozebird.com

merckcousa.com

frenchkissldn.com

lucyfaulknerllc.com

egekartus.com

bookyabber.com

cardiacimaginginpractice.com

deucessound.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1568-136-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral2/memory/3748-142-0x0000000003200000-0x000000000322A000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

COMPANY PROFILE_pdf.exeCOMPANY PROFILE_pdf.execolorcpl.exe

description	pid	process	target process
PID 3456 set thread context of 1568	3456	COMPANY PROFILE_pdf.exe	COMPANY PROFILE_pdf.exe
PID 1568 set thread context of 2412	1568	COMPANY PROFILE_pdf.exe	Explorer.EXE
PID 3748 set thread context of 2412	3748	colorcpl.exe	Explorer.EXE

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132887042651605940"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4052"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013094"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "9.375460"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3860"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

COMPANY PROFILE_pdf.execolorcpl.exe

pid	process
1568	COMPANY PROFILE_pdf.exe
1568	COMPANY PROFILE_pdf.exe
1568	COMPANY PROFILE_pdf.exe
1568	COMPANY PROFILE_pdf.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe
3748	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2412 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

COMPANY PROFILE_pdf.execolorcpl.exe

pid process

1568 COMPANY PROFILE_pdf.exe
1568 COMPANY PROFILE_pdf.exe
1568 COMPANY PROFILE_pdf.exe
3748 colorcpl.exe
3748 colorcpl.exe

pid	process
2412	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

COMPANY PROFILE_pdf.execolorcpl.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1568	COMPANY PROFILE_pdf.exe
Token: SeDebugPrivilege	3748	colorcpl.exe
Token: SeShutdownPrivilege	2412	Explorer.EXE
Token: SeCreatePagefilePrivilege	2412	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

COMPANY PROFILE_pdf.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 3456 wrote to memory of 1568	3456	COMPANY PROFILE_pdf.exe	COMPANY PROFILE_pdf.exe
PID 3456 wrote to memory of 1568	3456	COMPANY PROFILE_pdf.exe	COMPANY PROFILE_pdf.exe
PID 3456 wrote to memory of 1568	3456	COMPANY PROFILE_pdf.exe	COMPANY PROFILE_pdf.exe
PID 3456 wrote to memory of 1568	3456	COMPANY PROFILE_pdf.exe	COMPANY PROFILE_pdf.exe
PID 3456 wrote to memory of 1568	3456	COMPANY PROFILE_pdf.exe	COMPANY PROFILE_pdf.exe
PID 3456 wrote to memory of 1568	3456	COMPANY PROFILE_pdf.exe	COMPANY PROFILE_pdf.exe
PID 2412 wrote to memory of 3748	2412	Explorer.EXE	colorcpl.exe
PID 2412 wrote to memory of 3748	2412	Explorer.EXE	colorcpl.exe
PID 2412 wrote to memory of 3748	2412	Explorer.EXE	colorcpl.exe
PID 3748 wrote to memory of 1864	3748	colorcpl.exe	cmd.exe
PID 3748 wrote to memory of 1864	3748	colorcpl.exe	cmd.exe
PID 3748 wrote to memory of 1864	3748	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\COMPANY PROFILE_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\COMPANY PROFILE_pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Users\Admin\AppData\Local\Temp\COMPANY PROFILE_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\COMPANY PROFILE_pdf.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\COMPANY PROFILE_pdf.exe"
    3⤵
    PID:1864

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-136-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1568-139-0x0000000001520000-0x0000000001534000-memory.dmp

Filesize
80KB

Download
memory/1568-138-0x0000000000D30000-0x00000000014CA000-memory.dmp

Filesize
7.6MB

Download
memory/2412-140-0x0000000008200000-0x0000000008394000-memory.dmp

Filesize
1.6MB

Download
memory/2412-145-0x0000000007E70000-0x0000000007FB3000-memory.dmp

Filesize
1.3MB

Download
memory/3456-134-0x0000000004B30000-0x0000000004B3A000-memory.dmp

Filesize
40KB

Download
memory/3456-135-0x0000000007130000-0x00000000071CC000-memory.dmp

Filesize
624KB

Download
memory/3456-133-0x0000000004AD0000-0x0000000005074000-memory.dmp

Filesize
5.6MB

Download
memory/3456-132-0x0000000004B70000-0x0000000004C02000-memory.dmp

Filesize
584KB

Download
memory/3456-131-0x0000000005080000-0x0000000005624000-memory.dmp

Filesize
5.6MB

Download
memory/3456-130-0x00000000000E0000-0x0000000000180000-memory.dmp

Filesize
640KB

Download
memory/3748-141-0x0000000000A50000-0x0000000000A69000-memory.dmp

Filesize
100KB

Download
memory/3748-142-0x0000000003200000-0x000000000322A000-memory.dmp

Filesize
168KB

Download
memory/3748-143-0x00000000050F0000-0x000000000543A000-memory.dmp

Filesize
3.3MB

Download
memory/3748-144-0x0000000005040000-0x00000000050D3000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads