Managed XDR

120.eml (FormBookFormgrabber) — malware analysis report

File info

Filename
120.eml
File type
UTF-8 Unicode text
File size
2.2 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
bd16ac1bd5864c43c15a0d58049888f71e46a28c
SHA256
ae9294b573f777e93741e2785cbc9349133ff7e29062f447864a93d5a8cb41b2
MD5
78051cdfb3a8663677866cc3959d7ab8

Malwares

  • FormBookFormgrabber

Signatures

Execution

T1203 exploit_CVE_2017_11882: Exploits CVE-2017-11882 vulnerability
T1059 autoit: AutoIt script execution detected
T1204.002 mimics_extension: Attempts to mimic the file extension
T1059.003 suspicious_process: Spawns a suspicious process

Privilege Escalation

T1055.012 injection_runpe: Injects code into another process
T1055 sets_debug_registers: Sets debug registers for a thread in a different process
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1055.012 injection_runpe: Injects code into another process
T1027.002 unnamed_memory_regions_contains_pe: One or several unnamed memory regions are PE files
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1055 sets_debug_registers: Sets debug registers for a thread in a different process
T1036 mimics_extension: Attempts to mimic the file extension
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497 antidbg_query_system: Checks for kernel debugger (SystemKernelDebuggerInformation)
T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1497.002 async_mouse: Watches for mouse clicks using GetAsyncKeyState to detect human activity
T1480 system_default_lang_id_present: Checks the system language
T1070 stealth_window: A process created a hidden window

Credential Access

T1552 cookie_files: Accesses cookie files
T1555.003 cookie_files: Accesses cookie files

Discovery

T1497 antidbg_query_system: Checks for kernel debugger (SystemKernelDebuggerInformation)
T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1497.002 async_mouse: Watches for mouse clicks using GetAsyncKeyState to detect human activity
T1082 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining

Command and Control

T1071.001 network_cnc_http: Suspicious HTTP traffic
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet
T1102.003 cloud_amazonaws: Connects to cloud services of Amazon AWS (potentially for malicious payload delivery)

Other

yara_rules: Static rules
suricata_alert: Malicious traffic detected
ce_info: Formbook Configuration Data found
formbook: FormBook stealer found
suspicious_process_network: Unusual process network activity detected
dns_without_resolve: DNS query without a response
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card

Related reports

Managed XDR