formbook | 8a8fd3b40dfdd6add285caa0670b678a6fc7c65cbf1ba487fed174789ccb7793

General

Target

ghfg5776.exe
Size

284KB
MD5

bb0932c47b65c0ab72b9f9b87e26e292
SHA1

6a60a4798b6f4ded51f845c1c980b216b19ffc04
SHA256

90be634820b42505da42769e83ebc62ab133090c810b64140c551fc4136c5fe7
SHA512

51942eafa04c2abb8f0000400e16dd95b34d318d4e6592550c1fe884eb24b1132cfa946346f9a149042a2519800fa39f56e64082e0fa65eb30848687112f6548

Score

10^/10

formbook rv9n rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/724-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/724-117-0x000000000041F120-mapping.dmp	formbook
behavioral2/memory/2612-124-0x0000000002B70000-0x0000000002B9F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

ghfg5776.exe

pid process

1792 ghfg5776.exe

pid	process
1792	ghfg5776.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ghfg5776.exeghfg5776.execolorcpl.exe

description	pid	process	target process
PID 1792 set thread context of 724	1792	ghfg5776.exe	ghfg5776.exe
PID 724 set thread context of 3056	724	ghfg5776.exe	Explorer.EXE
PID 2612 set thread context of 3056	2612	colorcpl.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

ghfg5776.execolorcpl.exe

pid	process
724	ghfg5776.exe
724	ghfg5776.exe
724	ghfg5776.exe
724	ghfg5776.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3056 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

ghfg5776.execolorcpl.exe

pid process

724 ghfg5776.exe
724 ghfg5776.exe
724 ghfg5776.exe
2612 colorcpl.exe
2612 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ghfg5776.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 724 ghfg5776.exe
Token: SeDebugPrivilege 2612 colorcpl.exe

pid	process
3056	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	724	ghfg5776.exe
Token: SeDebugPrivilege	2612	colorcpl.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ghfg5776.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1792 wrote to memory of 724	1792	ghfg5776.exe	ghfg5776.exe
PID 1792 wrote to memory of 724	1792	ghfg5776.exe	ghfg5776.exe
PID 1792 wrote to memory of 724	1792	ghfg5776.exe	ghfg5776.exe
PID 1792 wrote to memory of 724	1792	ghfg5776.exe	ghfg5776.exe
PID 1792 wrote to memory of 724	1792	ghfg5776.exe	ghfg5776.exe
PID 1792 wrote to memory of 724	1792	ghfg5776.exe	ghfg5776.exe
PID 3056 wrote to memory of 2612	3056	Explorer.EXE	colorcpl.exe
PID 3056 wrote to memory of 2612	3056	Explorer.EXE	colorcpl.exe
PID 3056 wrote to memory of 2612	3056	Explorer.EXE	colorcpl.exe
PID 2612 wrote to memory of 3988	2612	colorcpl.exe	cmd.exe
PID 2612 wrote to memory of 3988	2612	colorcpl.exe	cmd.exe
PID 2612 wrote to memory of 3988	2612	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe
"C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe
"C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\ghfg5776.exe"
3⤵
PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nszDB10.tmp\lfsqlrxc.dll
MD5
bf4879c1784456b68a43d05a9ddd9535

SHA1
a0a366a68bb75fc3230ee43d6f8d42a71973dff1

SHA256
0605ba2116585eb673dea3125f0e48dcf90ac52a3e8725df986eddff467a2b47

SHA512
c60f3b1a00595828e07d17e5282f69622668b8c2b734402f152aab0566d0e38aff3b7a95da7c0483590b0087861df054af1fe5871c7310ab7c6a4d7314c4eccd

Download Submit
memory/724-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/724-117-0x000000000041F120-mapping.dmp

Download
memory/724-120-0x00000000009D0000-0x00000000009E4000-memory.dmp

Filesize
80KB

Download
memory/724-119-0x0000000000A50000-0x0000000000D70000-memory.dmp

Filesize
3.1MB

Download
memory/2612-122-0x0000000000000000-mapping.dmp

Download
memory/2612-124-0x0000000002B70000-0x0000000002B9F000-memory.dmp

Filesize
188KB

Download
memory/2612-123-0x0000000000100000-0x0000000000119000-memory.dmp

Filesize
100KB

Download
memory/2612-126-0x0000000004460000-0x0000000004780000-memory.dmp

Filesize
3.1MB

Download
memory/2612-127-0x0000000004360000-0x00000000043F3000-memory.dmp

Filesize
588KB

Download
memory/3056-121-0x0000000004F60000-0x000000000506A000-memory.dmp

Filesize
1.0MB

Download
memory/3056-128-0x0000000006140000-0x000000000624D000-memory.dmp

Filesize
1.1MB

Download
memory/3988-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads