formbook | ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5

General

Target
ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe
Size 1018KB
Sample260910-ndv8tawsas
SHA256 ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5
MD5 6ff26b74fc9ec8a190966a9caa97ae39
SHA1 e4f11c4bb4353382fcac5daef0c597e4f1f22cfa
SHA512 aa2a74553a0d9cdc9ed2c1f5663f84d6b94b2907a0944b4a4637e0a3ca0524cd0523858fbb32e327c1edc963e9579351b454184aa38ea93ebf3b8672342ccaee
SSDEEP 24576:3o+37zQve7hdBkyO2V8FwH/AsbxB8/7ke:3jzh3BvOy8FcA9ke
TLSH
T125252225A304F526DA6E1B3A0AB2D37167744D8DE538D36BCEED9DEB7D003516C08B82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1788-11-0x0000000000DF0000-0x0000000000E36000-memory.dmp	family_formbook

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/1360-6-0x0000000005AE0000-0x0000000005AF4000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 1788	1360	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	1788	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1360	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe
1360	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe
1788	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2708	1360	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe	86
PID 1360 wrote to memory of 1788	1360	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe	87
PID 1360 wrote to memory of 1788	1360	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe	87
PID 1360 wrote to memory of 1788	1360	ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe	87

C:\Users\Admin\AppData\Local\Temp\ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe
"C:\Users\Admin\AppData\Local\Temp\ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe
  "C:\Users\Admin\AppData\Local\Temp\ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe"
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe
  "C:\Users\Admin\AppData\Local\Temp\ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 188
    3⤵
    - Program crash
    PID:1840