formbook | 2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea

General

Target

2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
Size

416KB
MD5

a40d9c6f964664b6b5a3ec4ed532df6c
SHA1

4c1b1a2a6610c2f262c41112364e6629d11eb7f9
SHA256

2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea
SHA512

be4f84af50a13e4527d0da3c4ec91aae2ea2ee52e40066699fae1a11265f734d21c84b59c6ab58219014755c33ceb1b92ff13580b09b475644b40673231652b6

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1200-62-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1200-63-0x000000000041F200-mapping.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

pid process

1988 2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

pid	process
1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

description	pid	process	target process
PID 1988 set thread context of 1200	1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

pid process

1200 2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

pid	process
1200	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

description	pid	process	target process
PID 1988 wrote to memory of 1200	1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
PID 1988 wrote to memory of 1200	1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
PID 1988 wrote to memory of 1200	1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
PID 1988 wrote to memory of 1200	1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
PID 1988 wrote to memory of 1200	1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
PID 1988 wrote to memory of 1200	1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
PID 1988 wrote to memory of 1200	1988	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe	2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe

C:\Users\Admin\AppData\Local\Temp\2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
"C:\Users\Admin\AppData\Local\Temp\2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe
"C:\Users\Admin\AppData\Local\Temp\2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy43D5.tmp\xztemc.dll
MD5
9c1dba61231005537c4154af2d66b50a

SHA1
8a51892b643ace4c1a99b45e5b03df795b8bb984

SHA256
4f46b2449a7bd7a664b9328f240fc3bfa522e36918a0b672bec3015761d0b67d

SHA512
cd2fbf5b0a67885cd20dfb2fda999c0d9136d34e3c90745d39acf54a5bcf943e8eeb9ea9a53aa179f10aebec84e360582bdaa81604b879a05ef20813533c0ab7

Download Submit
memory/1200-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1200-63-0x000000000041F200-mapping.dmp

Download
memory/1200-64-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1988-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads