formbook | f62de2f1a6d9798f4278ab073890c06f8a1027c216d3c02dbc4c84ff84c4ee72

Analysis

max time kernel
147s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-01-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

915KB
MD5

c51050da2c94bbb62c6d2c51862b15dd
SHA1

84489f41759b69be75fa13430ba2f78143a857a1
SHA256

f62de2f1a6d9798f4278ab073890c06f8a1027c216d3c02dbc4c84ff84c4ee72
SHA512

9b22c562b3c84c0dce7a9888a227b67d991d4175d82ed2399d1629a216c0df9afc08285af94f06a09238ac896df2e0484d354bac4fab977bb2d3337a5b1521ef
SSDEEP

24576:nJzp/ZBD1bJJReGhyAynCXbwZ4pHzZhrh0Fy1:JVTD1Xhyn0bwZSnh0I

Score

10^/10

formbook guloader ce10 downloader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ce10

Decoy

universalbowls.com

bp5.site

thiagokielingwebdesign.net

grapper.fun

grow-more.us

cqdh888.com

facthunter.app

cstars05.xyz

baumeagency.com

montevallotowing.top

joshtdownes.com

ampvit88.info

timelesscoutureclothing.com

stimuscle.com

uppervillekeyword.top

victoriabaltzer.com

laguindah.art

kiddieboost.com

santafekeyword.top

818experience.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2088-629-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/2088-631-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/2424-664-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/2424-666-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
2128	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2024	file.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2088	file.exe
2088	file.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2024	file.exe
2088	file.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 2088	2024	file.exe	28
PID 2088 set thread context of 1224	2088	file.exe	10
PID 2088 set thread context of 1224	2088	file.exe	10
PID 2424 set thread context of 1224	2424	mstsc.exe	10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2088	file.exe
2088	file.exe
2088	file.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe
2424	mstsc.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2024	file.exe
2088	file.exe
2088	file.exe
2088	file.exe
2088	file.exe
2424	mstsc.exe
2424	mstsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	file.exe
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeDebugPrivilege	2424	mstsc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2088	2024	file.exe	28
PID 2024 wrote to memory of 2088	2024	file.exe	28
PID 2024 wrote to memory of 2088	2024	file.exe	28
PID 2024 wrote to memory of 2088	2024	file.exe	28
PID 2024 wrote to memory of 2088	2024	file.exe	28
PID 2024 wrote to memory of 2088	2024	file.exe	28
PID 1224 wrote to memory of 2424	1224	Explorer.EXE	33
PID 1224 wrote to memory of 2424	1224	Explorer.EXE	33
PID 1224 wrote to memory of 2424	1224	Explorer.EXE	33
PID 1224 wrote to memory of 2424	1224	Explorer.EXE	33
PID 2424 wrote to memory of 2128	2424	mstsc.exe	34
PID 2424 wrote to memory of 2128	2424	mstsc.exe	34
PID 2424 wrote to memory of 2128	2424	mstsc.exe	34
PID 2424 wrote to memory of 2128	2424	mstsc.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Deletes itself
    PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\fouette.ini

Filesize
44B

MD5
eb4da25d6c0d919bbe9ebc480cee0d05

SHA1
dfaeae9c23e9b282a82b1abb971599a5bcd51b27

SHA256
70a4ee88b132159f110d96ad83001187c6a272f52d5c766f563b50ac1e072fe3

SHA512
1e9972196d4bdbbc7366c1fc980014b3048d036f56afdeb39303263cc7af24217490dd9b9ca85ac11a0bf83a1c31eead3320e158e8b9ac819468023d1548cb5c

Download Submit
\Users\Admin\AppData\Local\Temp\nsy5A04.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/1224-630-0x0000000003920000-0x0000000003A20000-memory.dmp

Filesize
1024KB

Download
memory/1224-645-0x0000000006160000-0x0000000006264000-memory.dmp

Filesize
1.0MB

Download
memory/1224-655-0x0000000006270000-0x0000000006388000-memory.dmp

Filesize
1.1MB

Download
memory/1224-670-0x0000000007050000-0x000000000718D000-memory.dmp

Filesize
1.2MB

Download
memory/1224-672-0x0000000007050000-0x000000000718D000-memory.dmp

Filesize
1.2MB

Download
memory/1224-675-0x0000000007050000-0x000000000718D000-memory.dmp

Filesize
1.2MB

Download
memory/2024-596-0x0000000077A40000-0x0000000077BE9000-memory.dmp

Filesize
1.7MB

Download
memory/2024-597-0x0000000077C30000-0x0000000077D06000-memory.dmp

Filesize
856KB

Download
memory/2024-598-0x0000000074F60000-0x0000000074F67000-memory.dmp

Filesize
28KB

Download
memory/2088-635-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-643-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-602-0x0000000077C66000-0x0000000077C67000-memory.dmp

Filesize
4KB

Download
memory/2088-625-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-626-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-627-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-628-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-629-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-631-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-624-0x0000000001470000-0x00000000064ED000-memory.dmp

Filesize
80.5MB

Download
memory/2088-632-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-633-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-634-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-601-0x0000000077A40000-0x0000000077BE9000-memory.dmp

Filesize
1.7MB

Download
memory/2088-636-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-637-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-640-0x0000000036950000-0x0000000036964000-memory.dmp

Filesize
80KB

Download
memory/2088-641-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-642-0x0000000036AC0000-0x0000000036DC3000-memory.dmp

Filesize
3.0MB

Download
memory/2088-600-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-644-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-646-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-647-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-648-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-649-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-650-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-651-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-652-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-653-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2088-654-0x0000000035F50000-0x0000000035F64000-memory.dmp

Filesize
80KB

Download
memory/2088-659-0x0000000077C30000-0x0000000077D06000-memory.dmp

Filesize
856KB

Download
memory/2088-662-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2088-660-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2088-599-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2424-663-0x0000000000480000-0x0000000000584000-memory.dmp

Filesize
1.0MB

Download
memory/2424-664-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/2424-665-0x0000000002120000-0x0000000002423000-memory.dmp

Filesize
3.0MB

Download
memory/2424-661-0x0000000000480000-0x0000000000584000-memory.dmp

Filesize
1.0MB

Download
memory/2424-666-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/2424-668-0x0000000001FB0000-0x0000000002043000-memory.dmp

Filesize
588KB

Download