formbook | 81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90

General

Target

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
Size

266KB
MD5

f919de1034edc7b8a4a5a8aa8f0067dd
SHA1

ce50421738d5fb3108fe147dfdea5733fb01e19e
SHA256

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90
SHA512

946fafde24bf34a659d8df5bcd0db2ff3791b92c0fd36d96a9273436bbc75244cfb26cc9bf00d86370fc92d13d3e791905bc8f8fe97eb74e1ea3b556cd649b70
SSDEEP

6144:MtXZXPanzcQUuLgsNG0BPspB4nAFmklJB:Mtsz5DLgsp5ngDlj

Score

10^/10

formbook d06c discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d06c

Decoy

douglasdetoledopiza.com

yxcc.online

primo.llc

mediamomos.com

cosmetiq-pro.com

22labs.tech

turbowashing.com

lindaivell.site

princess-bed.club

groundget.cfd

agretaminiousa.com

lomoni.com

nessesse.us

lexgo.cloud

halilsener.xyz

kirokubo.cloud

corotip.sbs

meghq.net

5y6s.world

weasib.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4808-145-0x0000000000400000-0x0000000001654000-memory.dmp	formbook
behavioral1/memory/4808-146-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

Loads dropped DLL 1 IoCs

Processes:

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

pid process

5068 81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

pid process

4808 81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

pid	process
5068	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
4808	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

description	pid	process	target process
PID 5068 set thread context of 4808	5068	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

pid	process
4808	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
4808	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

pid process

5068 81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

description	pid	process	target process
PID 5068 wrote to memory of 4808	5068	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
PID 5068 wrote to memory of 4808	5068	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
PID 5068 wrote to memory of 4808	5068	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
PID 5068 wrote to memory of 4808	5068	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe	81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe

C:\Users\Admin\AppData\Local\Temp\81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
"C:\Users\Admin\AppData\Local\Temp\81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe
"C:\Users\Admin\AppData\Local\Temp\81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nslD76C.tmp\System.dll
Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
memory/4808-144-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download
memory/4808-145-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4808-142-0x0000000001660000-0x0000000001760000-memory.dmp

Filesize
1024KB

Download
memory/4808-143-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-137-0x0000000000000000-mapping.dmp

Download
memory/4808-149-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-138-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4808-140-0x0000000001660000-0x0000000001760000-memory.dmp

Filesize
1024KB

Download
memory/4808-150-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download
memory/4808-147-0x000000001D6A0000-0x000000001D9EA000-memory.dmp

Filesize
3.3MB

Download
memory/4808-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5068-139-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download
memory/5068-133-0x0000000004A00000-0x0000000004B01000-memory.dmp

Filesize
1.0MB

Download
memory/5068-136-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download
memory/5068-135-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp

Filesize
2.0MB

Download
memory/5068-148-0x0000000004A00000-0x0000000004B01000-memory.dmp

Filesize
1.0MB

Download
memory/5068-134-0x0000000004A00000-0x0000000004B01000-memory.dmp

Filesize
1.0MB

Download
memory/5068-141-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads