formbook | 0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd

General

Target

5cad52271422b36941487ad44a7ade44.exe
Size

255KB
MD5

5cad52271422b36941487ad44a7ade44
SHA1

0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba
SHA256

0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd
SHA512

b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab
SSDEEP

6144:RC2fT8maVl1F4rxzEc2qauQpeLXsS9ECZXQE3yH:pSv4rxwc2qweLXsSpX3yH

Score

10^/10

formbook guloader ms14 discovery downloader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ms14

Decoy

adjoinstaff.online

kmmdznky.cfd

keyviewgroup.com

kidomarketing.com

jroxtqpq.cfd

jdevmx.com

genqaagz.cfd

1cdpwp.cfd

francegoldvip.com

2qy218.xyz

peterscanner.com

trullys.com

aniwatch.top

windyhillcnc.com

pokazhu.com

r74jsy.cfd

paulgadgets.com

lindanewtee.com

lasik-de-de-8808230.zone

critone.site

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3664-146-0x0000000000400000-0x0000000001654000-memory.dmp	formbook

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	5cad52271422b36941487ad44a7ade44.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	5cad52271422b36941487ad44a7ade44.exe

Loads dropped DLL 1 IoCs

pid	Process
3796	5cad52271422b36941487ad44a7ade44.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3664	5cad52271422b36941487ad44a7ade44.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3796	5cad52271422b36941487ad44a7ade44.exe
3664	5cad52271422b36941487ad44a7ade44.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3796 set thread context of 3664	3796	5cad52271422b36941487ad44a7ade44.exe	95

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\sansningerne.Unc	5cad52271422b36941487ad44a7ade44.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Katje\falsebenet\Bike\Angivende.ini	5cad52271422b36941487ad44a7ade44.exe
File opened for modification	C:\Windows\resources\0409\Hovedgaarde.For	5cad52271422b36941487ad44a7ade44.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3664	5cad52271422b36941487ad44a7ade44.exe
3664	5cad52271422b36941487ad44a7ade44.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3796	5cad52271422b36941487ad44a7ade44.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 3664	3796	5cad52271422b36941487ad44a7ade44.exe	95
PID 3796 wrote to memory of 3664	3796	5cad52271422b36941487ad44a7ade44.exe	95
PID 3796 wrote to memory of 3664	3796	5cad52271422b36941487ad44a7ade44.exe	95
PID 3796 wrote to memory of 3664	3796	5cad52271422b36941487ad44a7ade44.exe	95

C:\Users\Admin\AppData\Local\Temp\5cad52271422b36941487ad44a7ade44.exe
"C:\Users\Admin\AppData\Local\Temp\5cad52271422b36941487ad44a7ade44.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Local\Temp\5cad52271422b36941487ad44a7ade44.exe
  "C:\Users\Admin\AppData\Local\Temp\5cad52271422b36941487ad44a7ade44.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsgB055.tmp\System.dll

Filesize
11KB

MD5
375e8a08471dc6f85f3828488b1147b3

SHA1
1941484ac710fc301a7d31d6f1345e32a21546af

SHA256
4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

SHA512
5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

Download Submit
memory/3664-144-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3664-145-0x00000000779F8000-0x00000000779F9000-memory.dmp

Filesize
4KB

Download
memory/3664-146-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3664-147-0x0000000001660000-0x0000000006329000-memory.dmp

Filesize
76.8MB

Download
memory/3664-149-0x00000000367B0000-0x0000000036AFA000-memory.dmp

Filesize
3.3MB

Download
memory/3664-150-0x0000000001660000-0x0000000006329000-memory.dmp

Filesize
76.8MB

Download
memory/3664-151-0x0000000077971000-0x0000000077A91000-memory.dmp

Filesize
1.1MB

Download
memory/3796-141-0x0000000077971000-0x0000000077A91000-memory.dmp

Filesize
1.1MB

Download
memory/3796-142-0x0000000077971000-0x0000000077A91000-memory.dmp

Filesize
1.1MB

Download
memory/3796-143-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing