formbook | 6351c69330812979b20ca0237dd523081e73bdec6b48c6a1bf8cac708b028ef9

General

Target

f919de1034edc7b8a4a5a8aa8f0067dd.exe
Size

266KB
MD5

a30c15bda927aeb2ff67b7bbc69aee4f
SHA1

9664785694f1b27cd5a6972dd2451a0499d77dac
SHA256

e86e7a5474975bd8099a89b34823da8d58195eb40f59d295b6d425a7763e2a1d
SHA512

5b7fbe69ce2d0e30068770a8667934c429f7d081a2413cbc28ca952f7b3640f341a5f8ba7f4508624e45a081838ed7da8f7413257c441652e19a1f7757255c1d
SSDEEP

6144:MtXZXPanzcQUuLgsNG0BPspB4nAFmklJ:Mtsz5DLgsp5ngDl

Score

10^/10

formbook d06c discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d06c

Decoy

douglasdetoledopiza.com

yxcc.online

primo.llc

mediamomos.com

cosmetiq-pro.com

22labs.tech

turbowashing.com

lindaivell.site

princess-bed.club

groundget.cfd

agretaminiousa.com

lomoni.com

nessesse.us

lexgo.cloud

halilsener.xyz

kirokubo.cloud

corotip.sbs

meghq.net

5y6s.world

weasib.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral4/memory/1316-147-0x0000000000400000-0x0000000001654000-memory.dmp	formbook
behavioral4/memory/1316-148-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f919de1034edc7b8a4a5a8aa8f0067dd.exef919de1034edc7b8a4a5a8aa8f0067dd.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	f919de1034edc7b8a4a5a8aa8f0067dd.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	f919de1034edc7b8a4a5a8aa8f0067dd.exe

Loads dropped DLL 1 IoCs

Processes:

f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid process

1388 f919de1034edc7b8a4a5a8aa8f0067dd.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid process

1316 f919de1034edc7b8a4a5a8aa8f0067dd.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

f919de1034edc7b8a4a5a8aa8f0067dd.exef919de1034edc7b8a4a5a8aa8f0067dd.exe

pid process

1388 f919de1034edc7b8a4a5a8aa8f0067dd.exe
1316 f919de1034edc7b8a4a5a8aa8f0067dd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f919de1034edc7b8a4a5a8aa8f0067dd.exe

description pid process target process

PID 1388 set thread context of 1316 1388 f919de1034edc7b8a4a5a8aa8f0067dd.exe f919de1034edc7b8a4a5a8aa8f0067dd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid process

1316 f919de1034edc7b8a4a5a8aa8f0067dd.exe
1316 f919de1034edc7b8a4a5a8aa8f0067dd.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid process

1388 f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid	process
1388	f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid	process
1316	f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid	process
1388	f919de1034edc7b8a4a5a8aa8f0067dd.exe
1316	f919de1034edc7b8a4a5a8aa8f0067dd.exe

description	pid	process	target process
PID 1388 set thread context of 1316	1388	f919de1034edc7b8a4a5a8aa8f0067dd.exe	f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid	process
1316	f919de1034edc7b8a4a5a8aa8f0067dd.exe
1316	f919de1034edc7b8a4a5a8aa8f0067dd.exe

pid	process
1388	f919de1034edc7b8a4a5a8aa8f0067dd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f919de1034edc7b8a4a5a8aa8f0067dd.exe

description	pid	process	target process
PID 1388 wrote to memory of 1316	1388	f919de1034edc7b8a4a5a8aa8f0067dd.exe	f919de1034edc7b8a4a5a8aa8f0067dd.exe
PID 1388 wrote to memory of 1316	1388	f919de1034edc7b8a4a5a8aa8f0067dd.exe	f919de1034edc7b8a4a5a8aa8f0067dd.exe
PID 1388 wrote to memory of 1316	1388	f919de1034edc7b8a4a5a8aa8f0067dd.exe	f919de1034edc7b8a4a5a8aa8f0067dd.exe
PID 1388 wrote to memory of 1316	1388	f919de1034edc7b8a4a5a8aa8f0067dd.exe	f919de1034edc7b8a4a5a8aa8f0067dd.exe

C:\Users\Admin\AppData\Local\Temp\f919de1034edc7b8a4a5a8aa8f0067dd.exe
"C:\Users\Admin\AppData\Local\Temp\f919de1034edc7b8a4a5a8aa8f0067dd.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\f919de1034edc7b8a4a5a8aa8f0067dd.exe
"C:\Users\Admin\AppData\Local\Temp\f919de1034edc7b8a4a5a8aa8f0067dd.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsq54AB.tmp\System.dll
Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
memory/1316-144-0x00000000779B0000-0x0000000077B53000-memory.dmp

Filesize
1.6MB

Download
memory/1316-146-0x00000000779B0000-0x0000000077B53000-memory.dmp

Filesize
1.6MB

Download
memory/1316-142-0x0000000001660000-0x0000000001760000-memory.dmp

Filesize
1024KB

Download
memory/1316-143-0x00007FFF063D0000-0x00007FFF065C5000-memory.dmp

Filesize
2.0MB

Download
memory/1316-137-0x0000000000000000-mapping.dmp

Download
memory/1316-138-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1316-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1316-140-0x0000000001660000-0x0000000001760000-memory.dmp

Filesize
1024KB

Download
memory/1316-150-0x000000001D620000-0x000000001D96A000-memory.dmp

Filesize
3.3MB

Download
memory/1316-147-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1316-145-0x00007FFF063D0000-0x00007FFF065C5000-memory.dmp

Filesize
2.0MB

Download
memory/1388-133-0x0000000004A00000-0x0000000004B01000-memory.dmp

Filesize
1.0MB

Download
memory/1388-136-0x00000000779B0000-0x0000000077B53000-memory.dmp

Filesize
1.6MB

Download
memory/1388-134-0x0000000004A00000-0x0000000004B01000-memory.dmp

Filesize
1.0MB

Download
memory/1388-135-0x00007FFF063D0000-0x00007FFF065C5000-memory.dmp

Filesize
2.0MB

Download
memory/1388-139-0x00000000779B0000-0x0000000077B53000-memory.dmp

Filesize
1.6MB

Download
memory/1388-149-0x0000000004A00000-0x0000000004B01000-memory.dmp

Filesize
1.0MB

Download
memory/1388-141-0x00007FFF063D0000-0x00007FFF065C5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads