formbook | c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e

General

Target

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
Size

553KB
MD5

1823dce627d29f5d4985501267f7ad9f
SHA1

1ce10042fccf2c8fcb2b0a93723f24b6c3b4ffb3
SHA256

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e
SHA512

88421fa99979a5ed7d55a2dccffbb96af3e72539e5dba61bf7860d2321a2f79deb5e9aae65e3fb9e5a17998a60d87abbbdc7b0dc495c991b4a3813a2ef8edb72

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/572-61-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/572-62-0x000000000041F200-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

description	pid	process	target process
PID 1548 set thread context of 572	1548	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

pid process

572 c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

pid	process
572	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

description	pid	process	target process
PID 1548 wrote to memory of 572	1548	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 1548 wrote to memory of 572	1548	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 1548 wrote to memory of 572	1548	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 1548 wrote to memory of 572	1548	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 1548 wrote to memory of 572	1548	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 1548 wrote to memory of 572	1548	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 1548 wrote to memory of 572	1548	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
"C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548

C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
"C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:572

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/572-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/572-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/572-62-0x000000000041F200-mapping.dmp

Download
memory/572-63-0x0000000000B00000-0x0000000000E03000-memory.dmp

Filesize
3.0MB

Download
memory/1548-53-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/1548-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1548-56-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/1548-57-0x00000000002F0000-0x00000000002F5000-memory.dmp

Filesize
20KB

Download
memory/1548-58-0x0000000004E70000-0x0000000004EE6000-memory.dmp

Filesize
472KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads