formbook | 8a8fd3b40dfdd6add285caa0670b678a6fc7c65cbf1ba487fed174789ccb7793

General

Target

ghfg5776.exe
Size

284KB
MD5

bb0932c47b65c0ab72b9f9b87e26e292
SHA1

6a60a4798b6f4ded51f845c1c980b216b19ffc04
SHA256

90be634820b42505da42769e83ebc62ab133090c810b64140c551fc4136c5fe7
SHA512

51942eafa04c2abb8f0000400e16dd95b34d318d4e6592550c1fe884eb24b1132cfa946346f9a149042a2519800fa39f56e64082e0fa65eb30848687112f6548

Score

10^/10

formbook rv9n rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1228-56-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1228-57-0x000000000041F120-mapping.dmp	formbook
behavioral1/memory/764-66-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1496 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

ghfg5776.exe

pid process

1520 ghfg5776.exe

pid	process
1496	cmd.exe

pid	process
1520	ghfg5776.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ghfg5776.exeghfg5776.execolorcpl.exe

description	pid	process	target process
PID 1520 set thread context of 1228	1520	ghfg5776.exe	ghfg5776.exe
PID 1228 set thread context of 1244	1228	ghfg5776.exe	Explorer.EXE
PID 764 set thread context of 1244	764	colorcpl.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

ghfg5776.execolorcpl.exe

pid	process
1228	ghfg5776.exe
1228	ghfg5776.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe
764	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

ghfg5776.execolorcpl.exe

pid process

1228 ghfg5776.exe
1228 ghfg5776.exe
1228 ghfg5776.exe
764 colorcpl.exe
764 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ghfg5776.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 1228 ghfg5776.exe
Token: SeDebugPrivilege 764 colorcpl.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE

pid	process
1244	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1228	ghfg5776.exe
Token: SeDebugPrivilege	764	colorcpl.exe

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ghfg5776.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1520 wrote to memory of 1228	1520	ghfg5776.exe	ghfg5776.exe
PID 1520 wrote to memory of 1228	1520	ghfg5776.exe	ghfg5776.exe
PID 1520 wrote to memory of 1228	1520	ghfg5776.exe	ghfg5776.exe
PID 1520 wrote to memory of 1228	1520	ghfg5776.exe	ghfg5776.exe
PID 1520 wrote to memory of 1228	1520	ghfg5776.exe	ghfg5776.exe
PID 1520 wrote to memory of 1228	1520	ghfg5776.exe	ghfg5776.exe
PID 1520 wrote to memory of 1228	1520	ghfg5776.exe	ghfg5776.exe
PID 1244 wrote to memory of 764	1244	Explorer.EXE	colorcpl.exe
PID 1244 wrote to memory of 764	1244	Explorer.EXE	colorcpl.exe
PID 1244 wrote to memory of 764	1244	Explorer.EXE	colorcpl.exe
PID 1244 wrote to memory of 764	1244	Explorer.EXE	colorcpl.exe
PID 764 wrote to memory of 1496	764	colorcpl.exe	cmd.exe
PID 764 wrote to memory of 1496	764	colorcpl.exe	cmd.exe
PID 764 wrote to memory of 1496	764	colorcpl.exe	cmd.exe
PID 764 wrote to memory of 1496	764	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe
"C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe
"C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe"
3⤵
- Deletes itself
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoCFD.tmp\lfsqlrxc.dll
MD5
bf4879c1784456b68a43d05a9ddd9535

SHA1
a0a366a68bb75fc3230ee43d6f8d42a71973dff1

SHA256
0605ba2116585eb673dea3125f0e48dcf90ac52a3e8725df986eddff467a2b47

SHA512
c60f3b1a00595828e07d17e5282f69622668b8c2b734402f152aab0566d0e38aff3b7a95da7c0483590b0087861df054af1fe5871c7310ab7c6a4d7314c4eccd

Download Submit
memory/764-62-0x0000000000000000-mapping.dmp

Download
memory/764-68-0x0000000000550000-0x00000000005E3000-memory.dmp

Filesize
588KB

Download
memory/764-67-0x0000000001F40000-0x0000000002243000-memory.dmp

Filesize
3.0MB

Download
memory/764-66-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/764-65-0x0000000000670000-0x0000000000688000-memory.dmp

Filesize
96KB

Download
memory/1228-57-0x000000000041F120-mapping.dmp

Download
memory/1228-60-0x00000000002D0000-0x00000000002E4000-memory.dmp

Filesize
80KB

Download
memory/1228-59-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download
memory/1228-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1244-61-0x0000000006240000-0x00000000063DA000-memory.dmp

Filesize
1.6MB

Download
memory/1244-69-0x0000000007E90000-0x0000000008005000-memory.dmp

Filesize
1.5MB

Download
memory/1496-64-0x0000000000000000-mapping.dmp

Download
memory/1520-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads