formbook | ec45c4a062540b9a29e88e73552cdf49aefd47541fd12b60a057daf25e406369

General

Target

Bulk Order_doc.exe
Size

257KB
MD5

96ff74bbd90b3cdae0266ab65e843532
SHA1

272907b9ba208989d0eb3e2da04eb1db0c693079
SHA256

7e3651ea716be4751d8402bdbce0d4457e186e515b0bc88763383677d968e345
SHA512

d8e12b5711b16f05b7640164a7039cf735aae3fe8a1cd1bf3b7af00ace945ea735020e83f40e0168b387f1cd24fabe74d94d93b6718a4dfb85fecb57ca46b9a2

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3792-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3792-117-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/3496-124-0x0000000000B30000-0x0000000000B5F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

Bulk Order_doc.exe

pid process

1796 Bulk Order_doc.exe

pid	process
1796	Bulk Order_doc.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Bulk Order_doc.exeBulk Order_doc.execontrol.exe

description	pid	process	target process
PID 1796 set thread context of 3792	1796	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 3792 set thread context of 2972	3792	Bulk Order_doc.exe	Explorer.EXE
PID 3496 set thread context of 2972	3496	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Bulk Order_doc.execontrol.exe

pid	process
3792	Bulk Order_doc.exe
3792	Bulk Order_doc.exe
3792	Bulk Order_doc.exe
3792	Bulk Order_doc.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe
3496	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2972 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Bulk Order_doc.execontrol.exe

pid process

3792 Bulk Order_doc.exe
3792 Bulk Order_doc.exe
3792 Bulk Order_doc.exe
3496 control.exe
3496 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Bulk Order_doc.execontrol.exe

description pid process

Token: SeDebugPrivilege 3792 Bulk Order_doc.exe
Token: SeDebugPrivilege 3496 control.exe

pid	process
2972	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3792	Bulk Order_doc.exe
Token: SeDebugPrivilege	3496	control.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Bulk Order_doc.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 1796 wrote to memory of 3792	1796	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1796 wrote to memory of 3792	1796	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1796 wrote to memory of 3792	1796	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1796 wrote to memory of 3792	1796	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1796 wrote to memory of 3792	1796	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 1796 wrote to memory of 3792	1796	Bulk Order_doc.exe	Bulk Order_doc.exe
PID 2972 wrote to memory of 3496	2972	Explorer.EXE	control.exe
PID 2972 wrote to memory of 3496	2972	Explorer.EXE	control.exe
PID 2972 wrote to memory of 3496	2972	Explorer.EXE	control.exe
PID 3496 wrote to memory of 3692	3496	control.exe	cmd.exe
PID 3496 wrote to memory of 3692	3496	control.exe	cmd.exe
PID 3496 wrote to memory of 3692	3496	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2972

C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe
"C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe
"C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Bulk Order_doc.exe"
3⤵
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsxB102.tmp\ezdrozcvjii.dll
MD5
929773e03b75ef165818c3aac557d026

SHA1
118777c4c92c57e48be311a864e9de9fcc399e1e

SHA256
147017f2ec63cf901fcec0caebf164087428758c29a64e9145c590624325caba

SHA512
2dffcaeb730cb99b43faffde29c7a20bb313d92864e57986a5c3a531f8affe4b34d4bc1622539518ca3d6e775beaa964f6add1ab4acbdad4476cc905aa1b4854

Download Submit
memory/2972-128-0x0000000005680000-0x00000000057EF000-memory.dmp

Filesize
1.4MB

Download
memory/2972-121-0x00000000030E0000-0x00000000031AD000-memory.dmp

Filesize
820KB

Download
memory/3496-123-0x0000000001380000-0x00000000013A0000-memory.dmp

Filesize
128KB

Download
memory/3496-127-0x0000000004A80000-0x0000000004B14000-memory.dmp

Filesize
592KB

Download
memory/3496-126-0x0000000004CE0000-0x0000000005000000-memory.dmp

Filesize
3.1MB

Download
memory/3496-122-0x0000000000000000-mapping.dmp

Download
memory/3496-124-0x0000000000B30000-0x0000000000B5F000-memory.dmp

Filesize
188KB

Download
memory/3692-125-0x0000000000000000-mapping.dmp

Download
memory/3792-119-0x0000000000990000-0x0000000000CB0000-memory.dmp

Filesize
3.1MB

Download
memory/3792-120-0x0000000000900000-0x0000000000915000-memory.dmp

Filesize
84KB

Download
memory/3792-117-0x000000000041F200-mapping.dmp

Download
memory/3792-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads