formbook | 6d725aa4c3dd38bc7f924af4891b82a9c993e2db67765c72be42778a9c1b561a

General

Target

Nouvel ordre.exe
Size

259KB
MD5

ba2cd86b94baeb58becd532319250fe2
SHA1

31e88e27c5840c2a0b7840d3c4c0acd489f0a8e5
SHA256

6d725aa4c3dd38bc7f924af4891b82a9c993e2db67765c72be42778a9c1b561a
SHA512

7c3b2b3c3446bd2c1ea04c2d84cfed87ee5b686af62702a06199619e2a96fba300b7ac91a1f14699e38d53ae342d16b38436bc9b2c54bc8967366d6031fc549b

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1264-56-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1264-57-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/1628-63-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1752 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Nouvel ordre.exe

pid process

1112 Nouvel ordre.exe

pid	process
1752	cmd.exe

pid	process
1112	Nouvel ordre.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Nouvel ordre.exeNouvel ordre.exewlanext.exe

description	pid	process	target process
PID 1112 set thread context of 1264	1112	Nouvel ordre.exe	Nouvel ordre.exe
PID 1264 set thread context of 1268	1264	Nouvel ordre.exe	Explorer.EXE
PID 1628 set thread context of 1268	1628	wlanext.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

Nouvel ordre.exewlanext.exe

pid	process
1264	Nouvel ordre.exe
1264	Nouvel ordre.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe
1628	wlanext.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Nouvel ordre.exewlanext.exe

pid process

1264 Nouvel ordre.exe
1264 Nouvel ordre.exe
1264 Nouvel ordre.exe
1628 wlanext.exe
1628 wlanext.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Nouvel ordre.exewlanext.exe

description pid process

Token: SeDebugPrivilege 1264 Nouvel ordre.exe
Token: SeDebugPrivilege 1628 wlanext.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE

pid	process
1268	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1264	Nouvel ordre.exe
Token: SeDebugPrivilege	1628	wlanext.exe

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Nouvel ordre.exeExplorer.EXEwlanext.exe

description	pid	process	target process
PID 1112 wrote to memory of 1264	1112	Nouvel ordre.exe	Nouvel ordre.exe
PID 1112 wrote to memory of 1264	1112	Nouvel ordre.exe	Nouvel ordre.exe
PID 1112 wrote to memory of 1264	1112	Nouvel ordre.exe	Nouvel ordre.exe
PID 1112 wrote to memory of 1264	1112	Nouvel ordre.exe	Nouvel ordre.exe
PID 1112 wrote to memory of 1264	1112	Nouvel ordre.exe	Nouvel ordre.exe
PID 1112 wrote to memory of 1264	1112	Nouvel ordre.exe	Nouvel ordre.exe
PID 1112 wrote to memory of 1264	1112	Nouvel ordre.exe	Nouvel ordre.exe
PID 1268 wrote to memory of 1628	1268	Explorer.EXE	wlanext.exe
PID 1268 wrote to memory of 1628	1268	Explorer.EXE	wlanext.exe
PID 1268 wrote to memory of 1628	1268	Explorer.EXE	wlanext.exe
PID 1268 wrote to memory of 1628	1268	Explorer.EXE	wlanext.exe
PID 1628 wrote to memory of 1752	1628	wlanext.exe	cmd.exe
PID 1628 wrote to memory of 1752	1628	wlanext.exe	cmd.exe
PID 1628 wrote to memory of 1752	1628	wlanext.exe	cmd.exe
PID 1628 wrote to memory of 1752	1628	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
- Deletes itself
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nslA5E0.tmp\cbspar.dll
MD5
31bff8b807f552a663c1a9b37a130564

SHA1
c91442fdd89050d3a37d234eb6595f11f1697afa

SHA256
8c25e6add26bc8ff4c545ced91b02663a2ba8222f1b5e5208910705186c12c9b

SHA512
316cae0648c6ec274b9d2f2ef13d3cc4033505f6859e0ad836bedbbee35356bb0ddaa18eb3d1cc71ec90885188d9df4ba7e41f6e09af4b417f9d475964e848c6

Download Submit
memory/1112-54-0x0000000075871000-0x0000000075873000-memory.dmp

Filesize
8KB

Download
memory/1264-58-0x0000000000810000-0x0000000000B13000-memory.dmp

Filesize
3.0MB

Download
memory/1264-57-0x000000000041F200-mapping.dmp

Download
memory/1264-59-0x00000000002D0000-0x00000000002E5000-memory.dmp

Filesize
84KB

Download
memory/1264-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1268-60-0x0000000004D60000-0x0000000004F0C000-memory.dmp

Filesize
1.7MB

Download
memory/1268-67-0x0000000006CC0000-0x0000000006E37000-memory.dmp

Filesize
1.5MB

Download
memory/1628-61-0x0000000000000000-mapping.dmp

Download
memory/1628-63-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1628-62-0x0000000000EC0000-0x0000000000ED6000-memory.dmp

Filesize
88KB

Download
memory/1628-65-0x0000000000AD0000-0x0000000000DD3000-memory.dmp

Filesize
3.0MB

Download
memory/1628-66-0x00000000008A0000-0x0000000000934000-memory.dmp

Filesize
592KB

Download
memory/1752-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads