formbook | 0fd7b17afcfaa921522141380792c3105ec20547c795a21c2eb0810c82e7e5e2

General

Target

SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe
Size

719KB
MD5

05f703e7a42a6c540c9d5c815eb17f88
SHA1

2fc5a59e412216cba76eb7fa122478bec8c2d125
SHA256

0fd7b17afcfaa921522141380792c3105ec20547c795a21c2eb0810c82e7e5e2
SHA512

8f7eca2be01bb273b7e18644b02d9358725baf3bd1d51919899226ac8e1a7b8050d018f0af72341eb4aa092150537f151f303513c92305d1dc44e5741bd1c6b0
SSDEEP

12288:HbAOmbLGin3WhvyX2GahiJ9//4BsEOeNOVOYPmMi0fq1r:HbPsLV3WhKX2GF///MsEfAVOKmMi0fM

Score

10^/10

formbook modiloader t3qw persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

t3qw

Decoy

cmv2ztfryZrE+3A/E6XVJY/zH13snw==

znM2r24wvyjMBxCX

RH+7M2Ut6PYms2mB6ho=

ZlPRueq+YTIhbwootBU3h8T3H13snw==

cVz99xUsBqvFN6B45U9nio0=

BXU3DIrcdhs2gNyk+lCCIoY=

uzBaz3kYIIMfK6V0Mr9FnhdNPg==

8rOZ/v+7fprLI6NzR+6HJl7EH13snw==

Pr2Wev5P6jlqWCiehQ==

dbzaPc5eWb5zVCPsyrU/

IeLgUQI37HLkFgKO

4xt3Y4yVega6l2LuLk5aovIhhLU=

2QdkbxFB8tkDMkQEyqg1

X1OV8wH0+lwCBwvIciO7Ug==

lYIX+/YAFhbMBxCX

DoxOV/qIixyT+HME6yyvTw==

GAuVkyRmIgwqdeGgIVU3iY8=

VMPRWwSKoDLoqJJuQ3B8kZI=

SAy2t2O1YK0dvad741U3iY8=

OOLZqb+rGSobYw==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3356-132-0x0000000004130000-0x000000000415B000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wiobdcde = "C:\\Users\\Public\\Libraries\\edcdboiW.url"	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

wscript.exehelp.exe

description	pid	process	target process
PID 2744 set thread context of 764	2744	wscript.exe	Explorer.EXE
PID 520 set thread context of 764	520	help.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

help.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	help.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

SecuriteInfo.com.Win32.DropperX-gen.15655.570.exewscript.exehelp.exe

pid	process
3356	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe
3356	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe
2744	wscript.exe
2744	wscript.exe
2744	wscript.exe
2744	wscript.exe
2744	wscript.exe
2744	wscript.exe
2744	wscript.exe
2744	wscript.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

764 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

wscript.exehelp.exe

pid process

2744 wscript.exe
2744 wscript.exe
2744 wscript.exe
520 help.exe
520 help.exe
520 help.exe
520 help.exe

pid	process
764	Explorer.EXE

pid	process
2744	wscript.exe
2744	wscript.exe
2744	wscript.exe
520	help.exe
520	help.exe
520	help.exe
520	help.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

wscript.exeExplorer.EXEhelp.exe

description	pid	process
Token: SeDebugPrivilege	2744	wscript.exe
Token: SeShutdownPrivilege	764	Explorer.EXE
Token: SeCreatePagefilePrivilege	764	Explorer.EXE
Token: SeShutdownPrivilege	764	Explorer.EXE
Token: SeCreatePagefilePrivilege	764	Explorer.EXE
Token: SeDebugPrivilege	520	help.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Win32.DropperX-gen.15655.570.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 3356 wrote to memory of 2744	3356	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe	wscript.exe
PID 3356 wrote to memory of 2744	3356	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe	wscript.exe
PID 3356 wrote to memory of 2744	3356	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe	wscript.exe
PID 3356 wrote to memory of 2744	3356	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe	wscript.exe
PID 3356 wrote to memory of 2744	3356	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe	wscript.exe
PID 3356 wrote to memory of 2744	3356	SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe	wscript.exe
PID 764 wrote to memory of 520	764	Explorer.EXE	help.exe
PID 764 wrote to memory of 520	764	Explorer.EXE	help.exe
PID 764 wrote to memory of 520	764	Explorer.EXE	help.exe
PID 520 wrote to memory of 1776	520	help.exe	Firefox.exe
PID 520 wrote to memory of 1776	520	help.exe	Firefox.exe
PID 520 wrote to memory of 1776	520	help.exe	Firefox.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.15655.570.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3356

C:\Windows\SysWOW64\wscript.exe
C:\Windows\System32\wscript.exe
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-144-0x0000000000000000-mapping.dmp

Download
memory/520-150-0x0000000000740000-0x000000000076D000-memory.dmp

Filesize
180KB

Download
memory/520-148-0x0000000000D80000-0x0000000000E0F000-memory.dmp

Filesize
572KB

Download
memory/520-147-0x0000000001110000-0x000000000145A000-memory.dmp

Filesize
3.3MB

Download
memory/520-146-0x0000000000740000-0x000000000076D000-memory.dmp

Filesize
180KB

Download
memory/520-145-0x0000000000A80000-0x0000000000A87000-memory.dmp

Filesize
28KB

Download
memory/764-143-0x0000000002D70000-0x0000000002EDC000-memory.dmp

Filesize
1.4MB

Download
memory/764-149-0x00000000081A0000-0x000000000827B000-memory.dmp

Filesize
876KB

Download
memory/764-151-0x00000000081A0000-0x000000000827B000-memory.dmp

Filesize
876KB

Download
memory/2744-141-0x0000000003E20000-0x000000000416A000-memory.dmp

Filesize
3.3MB

Download
memory/2744-142-0x0000000003D80000-0x0000000003D90000-memory.dmp

Filesize
64KB

Download
memory/2744-140-0x0000000010411000-0x000000001043F000-memory.dmp

Filesize
184KB

Download
memory/2744-139-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/2744-138-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/2744-134-0x0000000000000000-mapping.dmp

Download
memory/3356-132-0x0000000004130000-0x000000000415B000-memory.dmp

Filesize
172KB

Download
memory/3356-136-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/3356-135-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads