formbook | 43963f663331f1fa8342f4e3b7b2112e705ab5094b63bf51a639223321dcc901

General

Target

New Inquiry/New inquiry.exe
Size

236KB
MD5

dd1a098f5e803e0d80f1d7a7333ca8a5
SHA1

224bf29996d204c81e825c28b2955a6f2f01973f
SHA256

48c09aadd19df65dcb19eed8da77377e60aa7e6e5cba53ba0507faa9c550c193
SHA512

d0ef4d2a6dda49b0c513fb76a81f78cba3c67ace14b7254c580b8c41972406bbe3324c0ae7d5bd3e23ee916b8a9080c25b331a80ccf727635da373682627bfc1
SSDEEP

6144:i6bAcJ3iiPiaIj0sBo+0iBDQp9tHjaq8fRlilqaerDbI6Iu:JjIj0op0i1iHHTn0nkO

Score

10^/10

formbook d06c rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d06c

Decoy

douglasdetoledopiza.com

yxcc.online

primo.llc

mediamomos.com

cosmetiq-pro.com

22labs.tech

turbowashing.com

lindaivell.site

princess-bed.club

groundget.cfd

agretaminiousa.com

lomoni.com

nessesse.us

lexgo.cloud

halilsener.xyz

kirokubo.cloud

corotip.sbs

meghq.net

5y6s.world

weasib.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1508-70-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/1508-71-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/624-81-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/624-84-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

New inquiry.exeNew inquiry.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	New inquiry.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	New inquiry.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1580 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

New inquiry.exe

pid process

1048 New inquiry.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

New inquiry.exe

pid process

1508 New inquiry.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

New inquiry.exeNew inquiry.exe

pid process

1048 New inquiry.exe
1508 New inquiry.exe

pid	process
1580	cmd.exe

pid	process
1048	New inquiry.exe

pid	process
1048	New inquiry.exe
1508	New inquiry.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

New inquiry.exeNew inquiry.exewlanext.exe

description	pid	process	target process
PID 1048 set thread context of 1508	1048	New inquiry.exe	New inquiry.exe
PID 1508 set thread context of 1216	1508	New inquiry.exe	Explorer.EXE
PID 624 set thread context of 1216	624	wlanext.exe	Explorer.EXE

Drops file in Windows directory 1 IoCs

Processes:

New inquiry.exe

description ioc process

File created C:\Windows\Undividual\Tekstilarbejderens.lnk New inquiry.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Undividual\Tekstilarbejderens.lnk	New inquiry.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

New inquiry.exewlanext.exe

pid	process
1508	New inquiry.exe
1508	New inquiry.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe
624	wlanext.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

New inquiry.exeNew inquiry.exewlanext.exe

pid process

1048 New inquiry.exe
1508 New inquiry.exe
1508 New inquiry.exe
1508 New inquiry.exe
624 wlanext.exe
624 wlanext.exe

pid	process
1048	New inquiry.exe
1508	New inquiry.exe
1508	New inquiry.exe
1508	New inquiry.exe
624	wlanext.exe
624	wlanext.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

New inquiry.exeExplorer.EXEwlanext.exe

description	pid	process
Token: SeDebugPrivilege	1508	New inquiry.exe
Token: SeShutdownPrivilege	1216	Explorer.EXE
Token: SeDebugPrivilege	624	wlanext.exe
Token: SeShutdownPrivilege	1216	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1216 Explorer.EXE
1216 Explorer.EXE

Suspicious use of SendNotifyMessage 13 IoCs

Processes:

Explorer.EXE

pid	process
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

New inquiry.exeExplorer.EXEwlanext.exe

description	pid	process	target process
PID 1048 wrote to memory of 1508	1048	New inquiry.exe	New inquiry.exe
PID 1048 wrote to memory of 1508	1048	New inquiry.exe	New inquiry.exe
PID 1048 wrote to memory of 1508	1048	New inquiry.exe	New inquiry.exe
PID 1048 wrote to memory of 1508	1048	New inquiry.exe	New inquiry.exe
PID 1048 wrote to memory of 1508	1048	New inquiry.exe	New inquiry.exe
PID 1216 wrote to memory of 624	1216	Explorer.EXE	wlanext.exe
PID 1216 wrote to memory of 624	1216	Explorer.EXE	wlanext.exe
PID 1216 wrote to memory of 624	1216	Explorer.EXE	wlanext.exe
PID 1216 wrote to memory of 624	1216	Explorer.EXE	wlanext.exe
PID 624 wrote to memory of 1580	624	wlanext.exe	cmd.exe
PID 624 wrote to memory of 1580	624	wlanext.exe	cmd.exe
PID 624 wrote to memory of 1580	624	wlanext.exe	cmd.exe
PID 624 wrote to memory of 1580	624	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216

C:\Users\Admin\AppData\Local\Temp\New Inquiry\New inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\New Inquiry\New inquiry.exe"
2⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\New Inquiry\New inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\New Inquiry\New inquiry.exe"
3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\New Inquiry\New inquiry.exe"
3⤵
- Deletes itself
PID:1580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy2D59.tmp\System.dll
Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
memory/624-80-0x0000000000910000-0x0000000000926000-memory.dmp

Filesize
88KB

Download
memory/624-82-0x0000000002050000-0x0000000002353000-memory.dmp

Filesize
3.0MB

Download
memory/624-76-0x0000000000000000-mapping.dmp

Download
memory/624-84-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/624-81-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/624-83-0x00000000003B0000-0x0000000000443000-memory.dmp

Filesize
588KB

Download
memory/1048-56-0x0000000002760000-0x00000000033AA000-memory.dmp

Filesize
12.3MB

Download
memory/1048-62-0x0000000077BE0000-0x0000000077D60000-memory.dmp

Filesize
1.5MB

Download
memory/1048-63-0x0000000077BE0000-0x0000000077D60000-memory.dmp

Filesize
1.5MB

Download
memory/1048-75-0x0000000077BE0000-0x0000000077D60000-memory.dmp

Filesize
1.5MB

Download
memory/1048-57-0x0000000077A00000-0x0000000077BA9000-memory.dmp

Filesize
1.7MB

Download
memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1216-85-0x0000000004920000-0x00000000049D8000-memory.dmp

Filesize
736KB

Download
memory/1216-86-0x0000000004920000-0x00000000049D8000-memory.dmp

Filesize
736KB

Download
memory/1216-74-0x0000000004FB0000-0x000000000513F000-memory.dmp

Filesize
1.6MB

Download
memory/1508-72-0x000000001D330000-0x000000001D633000-memory.dmp

Filesize
3.0MB

Download
memory/1508-73-0x000000001CE90000-0x000000001D054000-memory.dmp

Filesize
1.8MB

Download
memory/1508-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1508-77-0x0000000077BE0000-0x0000000077D60000-memory.dmp

Filesize
1.5MB

Download
memory/1508-78-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/1508-70-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1508-69-0x0000000077BE0000-0x0000000077D60000-memory.dmp

Filesize
1.5MB

Download
memory/1508-68-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/1508-65-0x0000000077A00000-0x0000000077BA9000-memory.dmp

Filesize
1.7MB

Download
memory/1508-64-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/1508-61-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1508-60-0x0000000000403350-mapping.dmp

Download
memory/1580-79-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads