formbook | 024490bf99d2b77dc7943a5932bba385948feb7416fc434992593e72bad4782a

General

Target

BK8476699_BOOKING.exe
Size

465KB
MD5

0184924485a5bb35957ca5102af07b50
SHA1

e52aad204a9e5b6914885fc7325a44a1e088ca28
SHA256

024490bf99d2b77dc7943a5932bba385948feb7416fc434992593e72bad4782a
SHA512

bb7be885c9a3a71935ee5c916d89e223fed4362794132848fb0248ce1ba70801c81bdbfe5de35d6ce394e503f5ab276d9624c1325cfec822d02453882458682d

Score

10^/10

formbook guloader nff downloader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

nff

C2

http://www.yellow-wink.com/nff/

Decoy

shinseikai.site

creditmystartup.com

howtovvbucks.com

betterfromthebeginning.com

oubacm.com

stonalogov.com

gentrypartyof8.com

cuesticksandsupplies.com

joelsavestheday.com

llanobnb.com

ecclogic.com

miempaque.com

cai23668.com

miscdr.net

twzhhq.com

bloomandbrewcafe.com

angcomleisure.com

mafeeboutique.com

300coin.club

brooksranchhomes.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/268-67-0x0000000000401000-0x0000000000541000-memory.dmp	formbook
behavioral1/memory/268-68-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BK8476699_BOOKING.exeBK8476699_BOOKING.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	BK8476699_BOOKING.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	BK8476699_BOOKING.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

BK8476699_BOOKING.exeBK8476699_BOOKING.exe

pid process

1632 BK8476699_BOOKING.exe
268 BK8476699_BOOKING.exe
268 BK8476699_BOOKING.exe

pid	process
1632	BK8476699_BOOKING.exe
268	BK8476699_BOOKING.exe
268	BK8476699_BOOKING.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

BK8476699_BOOKING.exeBK8476699_BOOKING.exe

description	pid	process	target process
PID 1632 set thread context of 268	1632	BK8476699_BOOKING.exe	BK8476699_BOOKING.exe
PID 268 set thread context of 1376	268	BK8476699_BOOKING.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

BK8476699_BOOKING.exe

pid process

268 BK8476699_BOOKING.exe
268 BK8476699_BOOKING.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

BK8476699_BOOKING.exeBK8476699_BOOKING.exe

pid process

1632 BK8476699_BOOKING.exe
268 BK8476699_BOOKING.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

BK8476699_BOOKING.exe

description pid process

Token: SeDebugPrivilege 268 BK8476699_BOOKING.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BK8476699_BOOKING.exe

pid process

1632 BK8476699_BOOKING.exe

pid	process
268	BK8476699_BOOKING.exe
268	BK8476699_BOOKING.exe

pid	process
1632	BK8476699_BOOKING.exe
268	BK8476699_BOOKING.exe

description	pid	process
Token: SeDebugPrivilege	268	BK8476699_BOOKING.exe

pid	process
1632	BK8476699_BOOKING.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

BK8476699_BOOKING.exe

description	pid	process	target process
PID 1632 wrote to memory of 268	1632	BK8476699_BOOKING.exe	BK8476699_BOOKING.exe
PID 1632 wrote to memory of 268	1632	BK8476699_BOOKING.exe	BK8476699_BOOKING.exe
PID 1632 wrote to memory of 268	1632	BK8476699_BOOKING.exe	BK8476699_BOOKING.exe
PID 1632 wrote to memory of 268	1632	BK8476699_BOOKING.exe	BK8476699_BOOKING.exe
PID 1632 wrote to memory of 268	1632	BK8476699_BOOKING.exe	BK8476699_BOOKING.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\BK8476699_BOOKING.exe
"C:\Users\Admin\AppData\Local\Temp\BK8476699_BOOKING.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\BK8476699_BOOKING.exe
"C:\Users\Admin\AppData\Local\Temp\BK8476699_BOOKING.exe"
3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-66-0x0000000077C00000-0x0000000077D80000-memory.dmp

Filesize
1.5MB

Download
memory/268-65-0x0000000077A20000-0x0000000077BC9000-memory.dmp

Filesize
1.7MB

Download
memory/268-69-0x000000001E430000-0x000000001E733000-memory.dmp

Filesize
3.0MB

Download
memory/268-70-0x000000001DE60000-0x000000001E024000-memory.dmp

Filesize
1.8MB

Download
memory/268-59-0x00000000004014E4-mapping.dmp

Download
memory/268-60-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/268-68-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/268-67-0x0000000000401000-0x0000000000541000-memory.dmp

Filesize
1.2MB

Download
memory/268-62-0x00000000001B0000-0x00000000002B0000-memory.dmp

Filesize
1024KB

Download
memory/1376-71-0x00000000050B0000-0x00000000051BB000-memory.dmp

Filesize
1.0MB

Download
memory/1632-54-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/1632-61-0x0000000077C10000-0x0000000077CE6000-memory.dmp

Filesize
856KB

Download
memory/1632-57-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x0000000077A20000-0x0000000077BC9000-memory.dmp

Filesize
1.7MB

Download
memory/1632-58-0x0000000077C00000-0x0000000077D80000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads