formbook | ec45c4a062540b9a29e88e73552cdf49aefd47541fd12b60a057daf25e406369

General

Target

Bulk Order_doc.exe
Size

257KB
MD5

96ff74bbd90b3cdae0266ab65e843532
SHA1

272907b9ba208989d0eb3e2da04eb1db0c693079
SHA256

7e3651ea716be4751d8402bdbce0d4457e186e515b0bc88763383677d968e345
SHA512

d8e12b5711b16f05b7640164a7039cf735aae3fe8a1cd1bf3b7af00ace945ea735020e83f40e0168b387f1cd24fabe74d94d93b6718a4dfb85fecb57ca46b9a2

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1420-55-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1420-56-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/1756-65-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

576 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Bulk Order_doc.exe

pid process

1232 Bulk Order_doc.exe

pid	process
576	cmd.exe

pid	process
1232	Bulk Order_doc.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Bulk Order_doc.exeBulk Order_doc.execontrol.exe

description	pid	process	target process
PID 1232 set thread context of 1420	1232	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1420 set thread context of 1272	1420	Bulk Order_doc.exe	Explorer.EXE
PID 1756 set thread context of 1272	1756	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Bulk Order_doc.execontrol.exe

pid	process
1420	Bulk Order_doc.exe
1420	Bulk Order_doc.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe
1756	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Bulk Order_doc.execontrol.exe

pid process

1420 Bulk Order_doc.exe
1420 Bulk Order_doc.exe
1420 Bulk Order_doc.exe
1756 control.exe
1756 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Bulk Order_doc.execontrol.exe

description pid process

Token: SeDebugPrivilege 1420 Bulk Order_doc.exe
Token: SeDebugPrivilege 1756 control.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE

pid	process
1272	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1420	Bulk Order_doc.exe
Token: SeDebugPrivilege	1756	control.exe

pid	process
1272	Explorer.EXE
1272	Explorer.EXE

pid	process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Bulk Order_doc.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 1232 wrote to memory of 1420	1232	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1232 wrote to memory of 1420	1232	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1232 wrote to memory of 1420	1232	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1232 wrote to memory of 1420	1232	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1232 wrote to memory of 1420	1232	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1232 wrote to memory of 1420	1232	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1232 wrote to memory of 1420	1232	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1272 wrote to memory of 1756	1272	Explorer.EXE	control.exe
PID 1272 wrote to memory of 1756	1272	Explorer.EXE	control.exe
PID 1272 wrote to memory of 1756	1272	Explorer.EXE	control.exe
PID 1272 wrote to memory of 1756	1272	Explorer.EXE	control.exe
PID 1756 wrote to memory of 576	1756	control.exe	cmd.exe
PID 1756 wrote to memory of 576	1756	control.exe	cmd.exe
PID 1756 wrote to memory of 576	1756	control.exe	cmd.exe
PID 1756 wrote to memory of 576	1756	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe
"C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe
"C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe"
3⤵
- Deletes itself
PID:576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstBC5E.tmp\ezdrozcvjii.dll
MD5
929773e03b75ef165818c3aac557d026

SHA1
118777c4c92c57e48be311a864e9de9fcc399e1e

SHA256
147017f2ec63cf901fcec0caebf164087428758c29a64e9145c590624325caba

SHA512
2dffcaeb730cb99b43faffde29c7a20bb313d92864e57986a5c3a531f8affe4b34d4bc1622539518ca3d6e775beaa964f6add1ab4acbdad4476cc905aa1b4854

Download Submit
memory/576-63-0x0000000000000000-mapping.dmp

Download
memory/1232-53-0x0000000074F81000-0x0000000074F83000-memory.dmp

Filesize
8KB

Download
memory/1272-60-0x0000000007340000-0x000000000747E000-memory.dmp

Filesize
1.2MB

Download
memory/1272-68-0x0000000007480000-0x00000000075FD000-memory.dmp

Filesize
1.5MB

Download
memory/1420-56-0x000000000041F200-mapping.dmp

Download
memory/1420-59-0x0000000000340000-0x0000000000355000-memory.dmp

Filesize
84KB

Download
memory/1420-58-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download
memory/1420-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1756-61-0x0000000000000000-mapping.dmp

Download
memory/1756-64-0x00000000009C0000-0x00000000009DF000-memory.dmp

Filesize
124KB

Download
memory/1756-65-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1756-66-0x0000000001F70000-0x0000000002273000-memory.dmp

Filesize
3.0MB

Download
memory/1756-67-0x0000000000800000-0x0000000000894000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads