formbook | 5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900

General

Target

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
Size

673KB
MD5

0a4e34ccc6e3e118f225a4f38f731a14
SHA1

d8f89c49dbf6376607ea5379963bd95973fbfd18
SHA256

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900
SHA512

9fe90ed6095223ee98eb1372708cf77c7b2cd2482899bded7bd9f99f823afdeb89370309e0a087000e4345dab4b10a428ffd1d0afa486b7091f8fc3f30d0cc70
SSDEEP

12288:1XFAO9mjNkvzScpPdK/Pr595FUCCVjscJ4nX0q2mY9+QQh3HEc:1XFNQyvzSYlCNIV+nX0q2I3HEc

Score

10^/10

formbook guloader hy29 discovery downloader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy29

Decoy

obswell.online

etflix.luxury

ulunguwethu.store

ulbcenter.shop

nswering-service-mi-de-tt.click

upport-marketplace84.click

wepxbd163.lat

mplants-doctors.today

aofexf90yj.top

hermodynamic.space

dfg3n489.cyou

off.gay

alkak.cam

ijanarko.net

7tl.site

yaanincma.store

ires-47022.bond

elek4dalt77.xyz

foxsakepeople.online

ndefeatedqs.shop

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook
Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/860-17-0x0000000000400000-0x0000000001654000-memory.dmp	formbook
behavioral2/memory/860-18-0x0000000000400000-0x0000000001654000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid process

468 5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid process

860 5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid	process
468	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
860	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

description	pid	process	target process
PID 468 set thread context of 860	468	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Drops file in Windows directory 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

description ioc process

File opened for modification C:\Windows\fips\beskydende.ini 5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\fips\beskydende.ini	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid	process
860	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
860	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid process

468 5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

description	pid	process	target process
PID 468 wrote to memory of 860	468	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
PID 468 wrote to memory of 860	468	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
PID 468 wrote to memory of 860	468	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
PID 468 wrote to memory of 860	468	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
PID 468 wrote to memory of 860	468	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

C:\Users\Admin\AppData\Local\Temp\5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
"C:\Users\Admin\AppData\Local\Temp\5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\Temp\5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
  "C:\Users\Admin\AppData\Local\Temp\5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz853F.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
memory/468-12-0x00000000056F0000-0x0000000007BF9000-memory.dmp

Filesize
37.0MB

Download
memory/468-13-0x00000000775E1000-0x0000000077701000-memory.dmp

Filesize
1.1MB

Download
memory/468-14-0x00000000056F0000-0x0000000007BF9000-memory.dmp

Filesize
37.0MB

Download
memory/860-15-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/860-16-0x0000000001660000-0x0000000003B69000-memory.dmp

Filesize
37.0MB

Download
memory/860-17-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/860-18-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/860-19-0x0000000001660000-0x0000000003B69000-memory.dmp

Filesize
37.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads