formbook | 503d324cb44c441dafaabdec1455afe9a320cfceaa346198050f3ffad7c6aa8a

General

Target

120fa64f85b894d98a09843a4e0fe81a.exe
Size

782KB
MD5

120fa64f85b894d98a09843a4e0fe81a
SHA1

cccd0142f24a8939dd22d7176bafeeb60ffa67ae
SHA256

503d324cb44c441dafaabdec1455afe9a320cfceaa346198050f3ffad7c6aa8a
SHA512

ae9d4b1e7f539b90684207731ccf46b4500928957a10ccef75384149d15168d9980be6c6575a28199abb04294661cd97d1be6715a6f6941d2b222e2a94833793
SSDEEP

12288:9mHYsrAQMj7JP2cAmYOKe2ncjOQZlRDFHNFap4nruadYaeLw2Y:s4ZljB2tOUAOQZlZ1Hap4nya6RxY

Score

10^/10

formbook modiloader 3nop persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

Decoy

slot999.site

hagsahoy.com

howdyart.com

orders-marketplace.com

ranaa.email

masterlink.guru

archershut.com

weikumcommunications.com

dphardmoney.com

shjyutie.com

vivaberlin.net

mycto.today

curvygirlugc.com

otnmp.cfd

alwrists.com

propercandlecompany.com

allindustry-bg.com

theyoungbizacademy.com

expand658170.com

leslainesdumouchon.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1092-136-0x0000000010410000-0x000000001043F000-memory.dmp	formbook
behavioral2/memory/628-138-0x0000000010410000-0x000000001043F000-memory.dmp	formbook

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1092-132-0x0000000000810000-0x000000000083B000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

120fa64f85b894d98a09843a4e0fe81a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylbueznh = "C:\\Users\\Public\\Libraries\\hnzeublY.url"	120fa64f85b894d98a09843a4e0fe81a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

wscript.exe

description pid process target process

PID 628 set thread context of 2416 628 wscript.exe Explorer.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

120fa64f85b894d98a09843a4e0fe81a.exewscript.exe

pid process

1092 120fa64f85b894d98a09843a4e0fe81a.exe
1092 120fa64f85b894d98a09843a4e0fe81a.exe
628 wscript.exe
628 wscript.exe
628 wscript.exe
628 wscript.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2416 Explorer.EXE
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

wscript.exe

pid process

628 wscript.exe

description	pid	process	target process
PID 628 set thread context of 2416	628	wscript.exe	Explorer.EXE

pid	process
1092	120fa64f85b894d98a09843a4e0fe81a.exe
1092	120fa64f85b894d98a09843a4e0fe81a.exe
628	wscript.exe
628	wscript.exe
628	wscript.exe
628	wscript.exe

pid	process
2416	Explorer.EXE

pid	process
628	wscript.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

wscript.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	628	wscript.exe
Token: SeShutdownPrivilege	2416	Explorer.EXE
Token: SeCreatePagefilePrivilege	2416	Explorer.EXE
Token: SeShutdownPrivilege	2416	Explorer.EXE
Token: SeCreatePagefilePrivilege	2416	Explorer.EXE
Token: SeShutdownPrivilege	2416	Explorer.EXE
Token: SeCreatePagefilePrivilege	2416	Explorer.EXE
Token: SeShutdownPrivilege	2416	Explorer.EXE
Token: SeCreatePagefilePrivilege	2416	Explorer.EXE
Token: SeShutdownPrivilege	2416	Explorer.EXE
Token: SeCreatePagefilePrivilege	2416	Explorer.EXE
Token: SeShutdownPrivilege	2416	Explorer.EXE
Token: SeCreatePagefilePrivilege	2416	Explorer.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

120fa64f85b894d98a09843a4e0fe81a.exeExplorer.EXE

description	pid	process	target process
PID 1092 wrote to memory of 628	1092	120fa64f85b894d98a09843a4e0fe81a.exe	wscript.exe
PID 1092 wrote to memory of 628	1092	120fa64f85b894d98a09843a4e0fe81a.exe	wscript.exe
PID 1092 wrote to memory of 628	1092	120fa64f85b894d98a09843a4e0fe81a.exe	wscript.exe
PID 1092 wrote to memory of 628	1092	120fa64f85b894d98a09843a4e0fe81a.exe	wscript.exe
PID 1092 wrote to memory of 628	1092	120fa64f85b894d98a09843a4e0fe81a.exe	wscript.exe
PID 1092 wrote to memory of 628	1092	120fa64f85b894d98a09843a4e0fe81a.exe	wscript.exe
PID 2416 wrote to memory of 4572	2416	Explorer.EXE	netsh.exe
PID 2416 wrote to memory of 4572	2416	Explorer.EXE	netsh.exe
PID 2416 wrote to memory of 4572	2416	Explorer.EXE	netsh.exe

C:\Users\Admin\AppData\Local\Temp\120fa64f85b894d98a09843a4e0fe81a.exe
"C:\Users\Admin\AppData\Local\Temp\120fa64f85b894d98a09843a4e0fe81a.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\wscript.exe
C:\Windows\System32\wscript.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
PID:4572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-138-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/628-134-0x0000000000000000-mapping.dmp

Download
memory/628-140-0x0000000004320000-0x0000000004335000-memory.dmp

Filesize
84KB

Download
memory/628-139-0x0000000004410000-0x000000000475A000-memory.dmp

Filesize
3.3MB

Download
memory/1092-136-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/1092-132-0x0000000000810000-0x000000000083B000-memory.dmp

Filesize
172KB

Download
memory/1092-135-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/2416-141-0x0000000007C00000-0x0000000007D3E000-memory.dmp

Filesize
1.2MB

Download
memory/2416-142-0x0000000002B50000-0x0000000002B60000-memory.dmp

Filesize
64KB

Download
memory/2416-143-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

Filesize
64KB

Download
memory/2416-144-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/2416-145-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/2416-146-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

Filesize
64KB

Download
memory/2416-147-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/2416-148-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads