formbook | 1bc18c93db3e4a7aa6be09da21bff8ef310590a31e3d66e0e4dce94a546cdc9c

General

Target

New Order 09980.exe
Size

451KB
MD5

6387893aceaabeda2d1ab2eb5d902057
SHA1

1f8e30bf14f877fd200673e01cf53c45bb811fba
SHA256

05492398a92bdb980442a4893b4db7f34e440ba791653c1bd232a7d8a6577372
SHA512

bbfa58964f56e52e8edcfcc830c14da96d9532cac670f57d75d1d9699ac2bacc82be2d74571bc574546d522ea88479b9d6b7113e6cfe1a2f32b6681a4ba51bd7

Score

10^/10

formbook dn7r rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1636-56-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1636-57-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/1812-65-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2036 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

New Order 09980.exe

pid process

2004 New Order 09980.exe

pid	process
2036	cmd.exe

pid	process
2004	New Order 09980.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

New Order 09980.exeNew Order 09980.exewuapp.exe

description	pid	process	target process
PID 2004 set thread context of 1636	2004	New Order 09980.exe	New Order 09980.exe
PID 1636 set thread context of 1392	1636	New Order 09980.exe	Explorer.EXE
PID 1812 set thread context of 1392	1812	wuapp.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

New Order 09980.exewuapp.exe

pid	process
1636	New Order 09980.exe
1636	New Order 09980.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe
1812	wuapp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

New Order 09980.exewuapp.exe

pid process

1636 New Order 09980.exe
1636 New Order 09980.exe
1636 New Order 09980.exe
1812 wuapp.exe
1812 wuapp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

New Order 09980.exewuapp.exe

description pid process

Token: SeDebugPrivilege 1636 New Order 09980.exe
Token: SeDebugPrivilege 1812 wuapp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
1392 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
1392 Explorer.EXE

pid	process
1392	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1636	New Order 09980.exe
Token: SeDebugPrivilege	1812	wuapp.exe

pid	process
1392	Explorer.EXE
1392	Explorer.EXE

pid	process
1392	Explorer.EXE
1392	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

New Order 09980.exeExplorer.EXEwuapp.exe

description	pid	process	target process
PID 2004 wrote to memory of 1636	2004	New Order 09980.exe	New Order 09980.exe
PID 2004 wrote to memory of 1636	2004	New Order 09980.exe	New Order 09980.exe
PID 2004 wrote to memory of 1636	2004	New Order 09980.exe	New Order 09980.exe
PID 2004 wrote to memory of 1636	2004	New Order 09980.exe	New Order 09980.exe
PID 2004 wrote to memory of 1636	2004	New Order 09980.exe	New Order 09980.exe
PID 2004 wrote to memory of 1636	2004	New Order 09980.exe	New Order 09980.exe
PID 2004 wrote to memory of 1636	2004	New Order 09980.exe	New Order 09980.exe
PID 1392 wrote to memory of 1812	1392	Explorer.EXE	wuapp.exe
PID 1392 wrote to memory of 1812	1392	Explorer.EXE	wuapp.exe
PID 1392 wrote to memory of 1812	1392	Explorer.EXE	wuapp.exe
PID 1392 wrote to memory of 1812	1392	Explorer.EXE	wuapp.exe
PID 1392 wrote to memory of 1812	1392	Explorer.EXE	wuapp.exe
PID 1392 wrote to memory of 1812	1392	Explorer.EXE	wuapp.exe
PID 1392 wrote to memory of 1812	1392	Explorer.EXE	wuapp.exe
PID 1812 wrote to memory of 2036	1812	wuapp.exe	cmd.exe
PID 1812 wrote to memory of 2036	1812	wuapp.exe	cmd.exe
PID 1812 wrote to memory of 2036	1812	wuapp.exe	cmd.exe
PID 1812 wrote to memory of 2036	1812	wuapp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Local\Temp\New Order 09980.exe
"C:\Users\Admin\AppData\Local\Temp\New Order 09980.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\New Order 09980.exe
"C:\Users\Admin\AppData\Local\Temp\New Order 09980.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:564

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\New Order 09980.exe"
3⤵
- Deletes itself
PID:2036

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1360

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1364

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:984

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:540

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1372

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1212

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiF825.tmp\tlaw.dll
MD5
36ba5b2aa56fc49145add74cfa5cd714

SHA1
a68e60056319f297f3f061de77ad2eb7dcd5f000

SHA256
3aa1750df524835a9b19676f058616a9a8ba2093e3ccbae1d4b34ceb484600be

SHA512
1794e472a6a3220a1bef978e871233da58e718cf1fecc2be82391ce8abec73d3eaf1d730fd9013f32f642f204b0139190a59abbf9e50d55e7b9dbccbf31f7d67

Download Submit
memory/1392-61-0x0000000006BB0000-0x0000000006D2B000-memory.dmp

Filesize
1.5MB

Download
memory/1392-68-0x0000000004AD0000-0x0000000004B6B000-memory.dmp

Filesize
620KB

Download
memory/1636-57-0x000000000041F200-mapping.dmp

Download
memory/1636-58-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/1636-60-0x00000000002C0000-0x00000000002D5000-memory.dmp

Filesize
84KB

Download
memory/1636-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-62-0x0000000000000000-mapping.dmp

Download
memory/1812-65-0x0000000000090000-0x00000000000BF000-memory.dmp

Filesize
188KB

Download
memory/1812-64-0x0000000001180000-0x000000000118B000-memory.dmp

Filesize
44KB

Download
memory/1812-66-0x0000000000B10000-0x0000000000E13000-memory.dmp

Filesize
3.0MB

Download
memory/1812-67-0x0000000000840000-0x00000000008D4000-memory.dmp

Filesize
592KB

Download
memory/2004-54-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/2036-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads