formbook | f62de2f1a6d9798f4278ab073890c06f8a1027c216d3c02dbc4c84ff84c4ee72

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

915KB
MD5

c51050da2c94bbb62c6d2c51862b15dd
SHA1

84489f41759b69be75fa13430ba2f78143a857a1
SHA256

f62de2f1a6d9798f4278ab073890c06f8a1027c216d3c02dbc4c84ff84c4ee72
SHA512

9b22c562b3c84c0dce7a9888a227b67d991d4175d82ed2399d1629a216c0df9afc08285af94f06a09238ac896df2e0484d354bac4fab977bb2d3337a5b1521ef
SSDEEP

24576:nJzp/ZBD1bJJReGhyAynCXbwZ4pHzZhrh0Fy1:JVTD1Xhyn0bwZSnh0I

Score

10^/10

formbook guloader ce10 downloader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ce10

Decoy

universalbowls.com

bp5.site

thiagokielingwebdesign.net

grapper.fun

grow-more.us

cqdh888.com

facthunter.app

cstars05.xyz

baumeagency.com

montevallotowing.top

joshtdownes.com

ampvit88.info

timelesscoutureclothing.com

stimuscle.com

uppervillekeyword.top

victoriabaltzer.com

laguindah.art

kiddieboost.com

santafekeyword.top

818experience.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3640-616-0x0000000000400000-0x0000000001654000-memory.dmp	formbook
behavioral2/memory/3540-665-0x0000000000780000-0x00000000007AF000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

pid	Process
4496	file.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	drive.google.com
28	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3640	file.exe
3640	file.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4496	file.exe
3640	file.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 3640	4496	file.exe	91
PID 3640 set thread context of 3368	3640	file.exe	41
PID 3640 set thread context of 3368	3640	file.exe	41

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4484	3540	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3640	file.exe
3640	file.exe
3640	file.exe
3640	file.exe
3640	file.exe
3640	file.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4496	file.exe
3640	file.exe
3640	file.exe
3640	file.exe
3640	file.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	file.exe
Token: SeShutdownPrivilege	3368	Explorer.EXE
Token: SeCreatePagefilePrivilege	3368	Explorer.EXE
Token: SeShutdownPrivilege	3368	Explorer.EXE
Token: SeCreatePagefilePrivilege	3368	Explorer.EXE
Token: SeShutdownPrivilege	3368	Explorer.EXE
Token: SeCreatePagefilePrivilege	3368	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3640	4496	file.exe	91
PID 4496 wrote to memory of 3640	4496	file.exe	91
PID 4496 wrote to memory of 3640	4496	file.exe	91
PID 4496 wrote to memory of 3640	4496	file.exe	91
PID 4496 wrote to memory of 3640	4496	file.exe	91
PID 3368 wrote to memory of 3540	3368	Explorer.EXE	93
PID 3368 wrote to memory of 3540	3368	Explorer.EXE	93
PID 3368 wrote to memory of 3540	3368	Explorer.EXE	93

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  PID:3540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 296
    3⤵
    - Program crash
    PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3540 -ip 3540
1⤵
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\fouette.ini

Filesize
44B

MD5
eb4da25d6c0d919bbe9ebc480cee0d05

SHA1
dfaeae9c23e9b282a82b1abb971599a5bcd51b27

SHA256
70a4ee88b132159f110d96ad83001187c6a272f52d5c766f563b50ac1e072fe3

SHA512
1e9972196d4bdbbc7366c1fc980014b3048d036f56afdeb39303263cc7af24217490dd9b9ca85ac11a0bf83a1c31eead3320e158e8b9ac819468023d1548cb5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc737C.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/3368-632-0x0000000002F60000-0x0000000003031000-memory.dmp

Filesize
836KB

Download
memory/3368-664-0x0000000008A30000-0x0000000008B0B000-memory.dmp

Filesize
876KB

Download
memory/3540-659-0x00000000012B0000-0x00000000012CE000-memory.dmp

Filesize
120KB

Download
memory/3540-665-0x0000000000780000-0x00000000007AF000-memory.dmp

Filesize
188KB

Download
memory/3540-663-0x00000000012B0000-0x00000000012CE000-memory.dmp

Filesize
120KB

Download
memory/3640-637-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-642-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-613-0x0000000001660000-0x00000000066DD000-memory.dmp

Filesize
80.5MB

Download
memory/3640-616-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-617-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-618-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-619-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-620-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-621-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-622-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-623-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-624-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-625-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-626-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-627-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-628-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-629-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-630-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-631-0x0000000036BE0000-0x0000000036BF4000-memory.dmp

Filesize
80KB

Download
memory/3640-633-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-634-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-635-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-636-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-614-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-638-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-639-0x0000000036D30000-0x000000003707A000-memory.dmp

Filesize
3.3MB

Download
memory/3640-640-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-615-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-643-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-644-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-645-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-646-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-647-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-648-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-649-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-650-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-651-0x0000000000180000-0x0000000000194000-memory.dmp

Filesize
80KB

Download
memory/3640-652-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-653-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-654-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-655-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-656-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-657-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-658-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-661-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-600-0x0000000077E65000-0x0000000077E66000-memory.dmp

Filesize
4KB

Download
memory/3640-599-0x0000000077E48000-0x0000000077E49000-memory.dmp

Filesize
4KB

Download
memory/3640-598-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3640-660-0x0000000001660000-0x00000000066DD000-memory.dmp

Filesize
80.5MB

Download
memory/3640-668-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3640-667-0x0000000077DC1000-0x0000000077EE1000-memory.dmp

Filesize
1.1MB

Download
memory/3640-666-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4496-595-0x0000000077DC1000-0x0000000077EE1000-memory.dmp

Filesize
1.1MB

Download
memory/4496-596-0x0000000077DC1000-0x0000000077EE1000-memory.dmp

Filesize
1.1MB

Download
memory/4496-597-0x0000000074C20000-0x0000000074C27000-memory.dmp

Filesize
28KB

Download