formbook | 90661f85c7864f95181eceebf32eafd0b4b166aebdfdf5529edfc3a3dd6c0715

General

Target

rocviud123.exe
Size

254KB
MD5

9bb0511e947ca2a8ce34153f1b76400a
SHA1

311b128e5ef3995c04a754679237b778e85e7203
SHA256

90661f85c7864f95181eceebf32eafd0b4b166aebdfdf5529edfc3a3dd6c0715
SHA512

9741900e30ae1afee32dad16aceb55a98826be07d946a2d5a8dde8baeb5ad5a91ae9303b51f2a17d334c9335c63932f323f08102f9dbf287145f81c13f8a2bbf

Score

10^/10

formbook rv9n rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/984-62-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/984-63-0x000000000041F120-mapping.dmp	formbook
behavioral1/memory/1660-70-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1904 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rocviud123.exe

pid process

1304 rocviud123.exe

pid	process
1904	cmd.exe

pid	process
1304	rocviud123.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

rocviud123.exerocviud123.execmmon32.exe

description	pid	process	target process
PID 1304 set thread context of 984	1304	rocviud123.exe	rocviud123.exe
PID 984 set thread context of 1196	984	rocviud123.exe	Explorer.EXE
PID 1660 set thread context of 1196	1660	cmmon32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

rocviud123.execmmon32.exe

pid	process
984	rocviud123.exe
984	rocviud123.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe
1660	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

rocviud123.execmmon32.exe

pid process

984 rocviud123.exe
984 rocviud123.exe
984 rocviud123.exe
1660 cmmon32.exe
1660 cmmon32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rocviud123.execmmon32.exe

description pid process

Token: SeDebugPrivilege 984 rocviud123.exe
Token: SeDebugPrivilege 1660 cmmon32.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE

pid	process
1196	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	984	rocviud123.exe
Token: SeDebugPrivilege	1660	cmmon32.exe

pid	process
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

pid	process
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rocviud123.exeExplorer.EXEcmmon32.exe

description	pid	process	target process
PID 1304 wrote to memory of 984	1304	rocviud123.exe	rocviud123.exe
PID 1304 wrote to memory of 984	1304	rocviud123.exe	rocviud123.exe
PID 1304 wrote to memory of 984	1304	rocviud123.exe	rocviud123.exe
PID 1304 wrote to memory of 984	1304	rocviud123.exe	rocviud123.exe
PID 1304 wrote to memory of 984	1304	rocviud123.exe	rocviud123.exe
PID 1304 wrote to memory of 984	1304	rocviud123.exe	rocviud123.exe
PID 1304 wrote to memory of 984	1304	rocviud123.exe	rocviud123.exe
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	cmmon32.exe
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	cmmon32.exe
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	cmmon32.exe
PID 1196 wrote to memory of 1660	1196	Explorer.EXE	cmmon32.exe
PID 1660 wrote to memory of 1904	1660	cmmon32.exe	cmd.exe
PID 1660 wrote to memory of 1904	1660	cmmon32.exe	cmd.exe
PID 1660 wrote to memory of 1904	1660	cmmon32.exe	cmd.exe
PID 1660 wrote to memory of 1904	1660	cmmon32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196

C:\Users\Admin\AppData\Local\Temp\rocviud123.exe
"C:\Users\Admin\AppData\Local\Temp\rocviud123.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\rocviud123.exe
"C:\Users\Admin\AppData\Local\Temp\rocviud123.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\rocviud123.exe"
3⤵
- Deletes itself
PID:1904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsf4588.tmp\sapoqnmyo.dll
MD5
877d8bff6420ad9e9a3c2f8b443e78bc

SHA1
2b30780849a48aeb353d02eaa3e2a53492c5035f

SHA256
5c6ed2bf2593fe951107cb6eb64eb8064b768194c3ff32ef02a76c43810ae5e8

SHA512
35091c2b43094df03c33e3b6eb87f2817dffab50dd0aa0259b722509ec54e7bc3c9c60379082e880c32d199c3fc6afe142684845479c18483c4ac2e12a9de0ee

Download Submit
memory/984-65-0x0000000000340000-0x0000000000354000-memory.dmp

Filesize
80KB

Download
memory/984-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/984-63-0x000000000041F120-mapping.dmp

Download
memory/984-64-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download
memory/1196-66-0x0000000006D20000-0x0000000006E8F000-memory.dmp

Filesize
1.4MB

Download
memory/1196-73-0x0000000007170000-0x00000000072C4000-memory.dmp

Filesize
1.3MB

Download
memory/1196-74-0x0000000003A30000-0x0000000003A40000-memory.dmp

Filesize
64KB

Download
memory/1304-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1660-67-0x0000000000000000-mapping.dmp

Download
memory/1660-71-0x0000000001F20000-0x0000000002223000-memory.dmp

Filesize
3.0MB

Download
memory/1660-70-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1660-69-0x0000000000980000-0x000000000098D000-memory.dmp

Filesize
52KB

Download
memory/1660-72-0x0000000001D90000-0x0000000001E23000-memory.dmp

Filesize
588KB

Download
memory/1904-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads