formbook | 0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301

General

Target

0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe
Size

406KB
MD5

1482780bd41df6d1dfe68b2629c26d08
SHA1

17145bdc0f9beeea6f8cf5791210d0fd486818d1
SHA256

0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301
SHA512

e0fb5c4ae0ae98b231556950fd358feaebdd414f13e5dcf4eb6f3f77dd9ca5e5af930d04a362ceda9628b61029fa56d1659857dea7d3a1cab2ec8a94c0b974dd
SSDEEP

6144:TPXoDQpcUz+TfBDma1bJzSvPRehOGYJmcKeNq1umGANGc8b0:/WDfhNWRgJ8wkFA6b0

Score

10^/10

formbook guloader ms14 downloader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ms14

Decoy

adjoinstaff.online

kmmdznky.cfd

keyviewgroup.com

kidomarketing.com

jroxtqpq.cfd

jdevmx.com

genqaagz.cfd

1cdpwp.cfd

francegoldvip.com

2qy218.xyz

peterscanner.com

trullys.com

aniwatch.top

windyhillcnc.com

pokazhu.com

r74jsy.cfd

paulgadgets.com

lindanewtee.com

lasik-de-de-8808230.zone

critone.site

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/4376-145-0x0000000000400000-0x0000000001654000-memory.dmp	formbook

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe

Loads dropped DLL 1 IoCs

pid	Process
4524	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4376	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4524	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe
4376	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4524 set thread context of 4376	4524	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4376	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe
4376	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4524	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4376	4524	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe	94
PID 4524 wrote to memory of 4376	4524	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe	94
PID 4524 wrote to memory of 4376	4524	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe	94
PID 4524 wrote to memory of 4376	4524	0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe	94

C:\Users\Admin\AppData\Local\Temp\0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe
"C:\Users\Admin\AppData\Local\Temp\0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe
  "C:\Users\Admin\AppData\Local\Temp\0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsr7205.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/4376-142-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4376-143-0x00000000770D1000-0x00000000771F1000-memory.dmp

Filesize
1.1MB

Download
memory/4376-144-0x0000000077158000-0x0000000077159000-memory.dmp

Filesize
4KB

Download
memory/4376-145-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4376-146-0x0000000001660000-0x0000000005DF0000-memory.dmp

Filesize
71.6MB

Download
memory/4376-147-0x0000000036250000-0x000000003659A000-memory.dmp

Filesize
3.3MB

Download
memory/4376-148-0x0000000001660000-0x0000000005DF0000-memory.dmp

Filesize
71.6MB

Download
memory/4376-150-0x00000000770D1000-0x00000000771F1000-memory.dmp

Filesize
1.1MB

Download
memory/4524-140-0x00000000770D1000-0x00000000771F1000-memory.dmp

Filesize
1.1MB

Download
memory/4524-141-0x0000000073F30000-0x0000000073F36000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing