formbook | c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e

General

Target

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
Size

553KB
MD5

1823dce627d29f5d4985501267f7ad9f
SHA1

1ce10042fccf2c8fcb2b0a93723f24b6c3b4ffb3
SHA256

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e
SHA512

88421fa99979a5ed7d55a2dccffbb96af3e72539e5dba61bf7860d2321a2f79deb5e9aae65e3fb9e5a17998a60d87abbbdc7b0dc495c991b4a3813a2ef8edb72

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2820-123-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2820-124-0x000000000041F200-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

description	pid	process	target process
PID 640 set thread context of 2820	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exec14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

pid	process
640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
2820	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
2820	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

description pid process

Token: SeDebugPrivilege 640 c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

description	pid	process
Token: SeDebugPrivilege	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

description	pid	process	target process
PID 640 wrote to memory of 1532	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 640 wrote to memory of 1532	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 640 wrote to memory of 1532	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 640 wrote to memory of 2820	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 640 wrote to memory of 2820	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 640 wrote to memory of 2820	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 640 wrote to memory of 2820	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 640 wrote to memory of 2820	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
PID 640 wrote to memory of 2820	640	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe	c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe

C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
"C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
"C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe"
2⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe
"C:\Users\Admin\AppData\Local\Temp\c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-114-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/640-116-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/640-117-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/640-118-0x0000000005290000-0x000000000578E000-memory.dmp

Filesize
5.0MB

Download
memory/640-119-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/640-120-0x0000000005410000-0x0000000005415000-memory.dmp

Filesize
20KB

Download
memory/640-121-0x0000000006F70000-0x0000000006F71000-memory.dmp

Filesize
4KB

Download
memory/640-122-0x0000000007790000-0x0000000007806000-memory.dmp

Filesize
472KB

Download
memory/2820-123-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2820-124-0x000000000041F200-mapping.dmp

Download
memory/2820-125-0x0000000001060000-0x0000000001380000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads