formbook | d9461e44f7e733f57fe3b98291531b4e506978b8a511d265c95d1d7715b3159b

General

Target

Orden specifications_pdf.exe
Size

253KB
MD5

c95fe63506ee881dc52a785afa1afd59
SHA1

f82a362e2b732f8d7ce36b5ec23ccb4d52eac15d
SHA256

cb1140dd7751382a2d56c59755a2ff38b239805148af2d108cf4f1399ca0f753
SHA512

9fc1103f862c728a107ea9d0b83026e3d400c323bcccd25b548eaa73a2a0d329d05ce8da6bb81439109a8189a08a826e241cfe251e3010b6da631dad4793ec40

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2468-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2468-117-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/2512-123-0x0000000001220000-0x000000000124F000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

Processes:

cmd.exe

flow pid process

11 2512 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Orden specifications_pdf.exe

pid process

2208 Orden specifications_pdf.exe

flow	pid	process
11	2512	cmd.exe

pid	process
2208	Orden specifications_pdf.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Orden specifications_pdf.exeOrden specifications_pdf.execmd.exe

description	pid	process	target process
PID 2208 set thread context of 2468	2208	Orden specifications_pdf.exe	Orden specifications_pdf.exe
PID 2468 set thread context of 3040	2468	Orden specifications_pdf.exe	Explorer.EXE
PID 2512 set thread context of 3040	2512	cmd.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Orden specifications_pdf.execmd.exe

pid	process
2468	Orden specifications_pdf.exe
2468	Orden specifications_pdf.exe
2468	Orden specifications_pdf.exe
2468	Orden specifications_pdf.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe
2512	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3040 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Orden specifications_pdf.execmd.exe

pid process

2468 Orden specifications_pdf.exe
2468 Orden specifications_pdf.exe
2468 Orden specifications_pdf.exe
2512 cmd.exe
2512 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Orden specifications_pdf.execmd.exe

description pid process

Token: SeDebugPrivilege 2468 Orden specifications_pdf.exe
Token: SeDebugPrivilege 2512 cmd.exe

pid	process
3040	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2468	Orden specifications_pdf.exe
Token: SeDebugPrivilege	2512	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Orden specifications_pdf.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 2208 wrote to memory of 2468	2208	Orden specifications_pdf.exe	Orden specifications_pdf.exe
PID 2208 wrote to memory of 2468	2208	Orden specifications_pdf.exe	Orden specifications_pdf.exe
PID 2208 wrote to memory of 2468	2208	Orden specifications_pdf.exe	Orden specifications_pdf.exe
PID 2208 wrote to memory of 2468	2208	Orden specifications_pdf.exe	Orden specifications_pdf.exe
PID 2208 wrote to memory of 2468	2208	Orden specifications_pdf.exe	Orden specifications_pdf.exe
PID 2208 wrote to memory of 2468	2208	Orden specifications_pdf.exe	Orden specifications_pdf.exe
PID 3040 wrote to memory of 2512	3040	Explorer.EXE	cmd.exe
PID 3040 wrote to memory of 2512	3040	Explorer.EXE	cmd.exe
PID 3040 wrote to memory of 2512	3040	Explorer.EXE	cmd.exe
PID 2512 wrote to memory of 2796	2512	cmd.exe	cmd.exe
PID 2512 wrote to memory of 2796	2512	cmd.exe	cmd.exe
PID 2512 wrote to memory of 2796	2512	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\Orden specifications_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Orden specifications_pdf.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208

C:\Users\Admin\AppData\Local\Temp\Orden specifications_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Orden specifications_pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Orden specifications_pdf.exe"
3⤵
PID:2796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso9041.tmp\wkpy.dll
MD5
8f789a523145181f5d8db581d2335a6c

SHA1
8ccdb3de7cd8cca62f479a70669bfd1355a33cc5

SHA256
3fee841d37b1d765888c03ff08c2c6f68ce3a6192106d7f71bd33324501a42ba

SHA512
19958e41d0a3d4b2dc398297b144853db1bb0fc90a3f3cad03168c8dc49f6f58cafd420c502f2be8b51396d8b1271541e20fcb29b5400c2ec2d755dbb0baf6b8

Download Submit
memory/2468-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2468-117-0x000000000041F200-mapping.dmp

Download
memory/2468-119-0x00000000009D0000-0x00000000009E5000-memory.dmp

Filesize
84KB

Download
memory/2468-118-0x0000000000AF0000-0x0000000000E10000-memory.dmp

Filesize
3.1MB

Download
memory/2512-121-0x0000000000000000-mapping.dmp

Download
memory/2512-122-0x0000000001390000-0x00000000013E9000-memory.dmp

Filesize
356KB

Download
memory/2512-123-0x0000000001220000-0x000000000124F000-memory.dmp

Filesize
188KB

Download
memory/2512-124-0x0000000003AA0000-0x0000000003DC0000-memory.dmp

Filesize
3.1MB

Download
memory/2512-126-0x0000000003DC0000-0x0000000003E54000-memory.dmp

Filesize
592KB

Download
memory/2796-125-0x0000000000000000-mapping.dmp

Download
memory/3040-120-0x0000000006920000-0x0000000006A56000-memory.dmp

Filesize
1.2MB

Download
memory/3040-127-0x0000000007170000-0x00000000072A7000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads