formbook | 7fa778a38b6adbec2ed8ca4e50d2971c4f135c1bf3b7c24a9adb8f86d3ad2ec5

General

Target

SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe
Size

684KB
MD5

0379ae001c1c573492d6691c94d2a540
SHA1

f92b3c78bb2170074ae40f92743432ef10d55f06
SHA256

7fa778a38b6adbec2ed8ca4e50d2971c4f135c1bf3b7c24a9adb8f86d3ad2ec5
SHA512

d1137357639c3c55460cde25047a4f9706c5ab6501b996cff0ffc30468d4f534da9433218d0a7a4b1c7c2badaf3e44e786443c0b9543b0cc7868f19d28257658
SSDEEP

12288:Zrl405A0lVmc7QFRj+ppGLVXcw1916s5cIGdbT0POkCU4H011Q+T3l+zj:BplVTE/9KC916s5cIMkCUFqC3wzj

Score

10^/10

formbook 4u5a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

4u5a

Decoy

Y9HWoINcPu0r7SSSKt4FCmk7

G/E64auYdhRQM4wZW2bcOaY=

bL57APty/StRpW49a+EdxA==

TppryJ0SoslHe8gJFVc=

HXxDShYIEcUJDahdv2nvl5Hlbp4=

EKaq5c6w0nV3WWlEqM4Www==

VM+YjE8XS1OLcH1roYF4zA==

OwK0wxmBGnq2Fg==

B1zy4bulyfY9tj9DK2eIkeYArpTt

Avj5JeA8m9girqfQ4+cZxA==

AOY4dmDFkCdX8HUJMw==

5cQUw3pPMYr07V8=

P7ZsN4/zt63AEw==

FYyVCOpB8Vl//kSkDLPo91Yy

jxwZTBp+5gcsccPxDF+K4bDG2Rpp0A==

iGx9AO58DRhZbXX9

prwVyLkAtlhSU6irmansg8wArpTt

uqa8ZPl+FFObOkdFNg==

tL4OhF22EDaEOkdFNg==

6exH76Z9o7eu/n86vgPE

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

Processes:

SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exeCaspol.execscript.exe

description	pid	process	target process
PID 2200 set thread context of 816	2200	SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe	Caspol.exe
PID 816 set thread context of 2724	816	Caspol.exe	Explorer.EXE
PID 5012 set thread context of 2724	5012	cscript.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cscript.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cscript.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

Caspol.execscript.exe

pid	process
816	Caspol.exe
816	Caspol.exe
816	Caspol.exe
816	Caspol.exe
816	Caspol.exe
816	Caspol.exe
816	Caspol.exe
816	Caspol.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe
5012	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2724 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Caspol.execscript.exe

pid process

816 Caspol.exe
816 Caspol.exe
816 Caspol.exe
5012 cscript.exe
5012 cscript.exe
5012 cscript.exe
5012 cscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Caspol.execscript.exe

description pid process

Token: SeDebugPrivilege 816 Caspol.exe
Token: SeDebugPrivilege 5012 cscript.exe

pid	process
2724	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	816	Caspol.exe
Token: SeDebugPrivilege	5012	cscript.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 2200 wrote to memory of 816	2200	SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe	Caspol.exe
PID 2200 wrote to memory of 816	2200	SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe	Caspol.exe
PID 2200 wrote to memory of 816	2200	SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe	Caspol.exe
PID 2200 wrote to memory of 816	2200	SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe	Caspol.exe
PID 2200 wrote to memory of 816	2200	SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe	Caspol.exe
PID 2200 wrote to memory of 816	2200	SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe	Caspol.exe
PID 2724 wrote to memory of 5012	2724	Explorer.EXE	cscript.exe
PID 2724 wrote to memory of 5012	2724	Explorer.EXE	cscript.exe
PID 2724 wrote to memory of 5012	2724	Explorer.EXE	cscript.exe
PID 5012 wrote to memory of 2476	5012	cscript.exe	Firefox.exe
PID 5012 wrote to memory of 2476	5012	cscript.exe	Firefox.exe
PID 5012 wrote to memory of 2476	5012	cscript.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2724

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.345.21626.32453.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:2476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-139-0x0000000001890000-0x0000000001BDA000-memory.dmp

Filesize
3.3MB

Download
memory/816-133-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/816-134-0x00000000004012B0-mapping.dmp

Download
memory/816-142-0x0000000001260000-0x0000000001270000-memory.dmp

Filesize
64KB

Download
memory/816-141-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/816-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/816-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2200-137-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-132-0x000001898ADB0000-0x000001898AE62000-memory.dmp

Filesize
712KB

Download
memory/2200-135-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/2724-143-0x00000000028A0000-0x000000000299D000-memory.dmp

Filesize
1012KB

Download
memory/2724-150-0x00000000029E0000-0x0000000002AAF000-memory.dmp

Filesize
828KB

Download
memory/2724-151-0x00000000029E0000-0x0000000002AAF000-memory.dmp

Filesize
828KB

Download
memory/5012-144-0x0000000000000000-mapping.dmp

Download
memory/5012-146-0x0000000000380000-0x00000000003AD000-memory.dmp

Filesize
180KB

Download
memory/5012-145-0x0000000000620000-0x0000000000647000-memory.dmp

Filesize
156KB

Download
memory/5012-147-0x0000000002770000-0x0000000002ABA000-memory.dmp

Filesize
3.3MB

Download
memory/5012-148-0x0000000000380000-0x00000000003AD000-memory.dmp

Filesize
180KB

Download
memory/5012-149-0x00000000025A0000-0x000000000262F000-memory.dmp

Filesize
572KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads