formbook | e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac

General

Target

rrwq200123.exe
Size

253KB
MD5

3a5c5bb43232e4e48b63cdf123dec876
SHA1

95b478c57de28b87d6bd87dd32a4faec02b0d620
SHA256

e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac
SHA512

59bd907d7faa8aab41c1cfc78d0aabf8592e8e1e8b49abc4340b807718b96d2e281270f15a5767d6df4e4acde5375ed20756c8598019ed927866dc25c70f7281

Score

10^/10

formbook rv9n rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4072-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4072-117-0x000000000041F120-mapping.dmp	formbook
behavioral2/memory/4076-127-0x0000000000E50000-0x0000000000E7F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

rrwq200123.exe

pid process

3716 rrwq200123.exe

pid	process
3716	rrwq200123.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

rrwq200123.exerrwq200123.exemsiexec.exe

description	pid	process	target process
PID 3716 set thread context of 4072	3716	rrwq200123.exe	rrwq200123.exe
PID 4072 set thread context of 2712	4072	rrwq200123.exe	Explorer.EXE
PID 4076 set thread context of 2712	4076	msiexec.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

rrwq200123.exemsiexec.exe

pid	process
4072	rrwq200123.exe
4072	rrwq200123.exe
4072	rrwq200123.exe
4072	rrwq200123.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe
4076	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2712 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

rrwq200123.exemsiexec.exe

pid process

4072 rrwq200123.exe
4072 rrwq200123.exe
4072 rrwq200123.exe
4076 msiexec.exe
4076 msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rrwq200123.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 4072 rrwq200123.exe
Token: SeDebugPrivilege 4076 msiexec.exe

pid	process
2712	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	4072	rrwq200123.exe
Token: SeDebugPrivilege	4076	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rrwq200123.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 3716 wrote to memory of 4072	3716	rrwq200123.exe	rrwq200123.exe
PID 3716 wrote to memory of 4072	3716	rrwq200123.exe	rrwq200123.exe
PID 3716 wrote to memory of 4072	3716	rrwq200123.exe	rrwq200123.exe
PID 3716 wrote to memory of 4072	3716	rrwq200123.exe	rrwq200123.exe
PID 3716 wrote to memory of 4072	3716	rrwq200123.exe	rrwq200123.exe
PID 3716 wrote to memory of 4072	3716	rrwq200123.exe	rrwq200123.exe
PID 2712 wrote to memory of 4076	2712	Explorer.EXE	msiexec.exe
PID 2712 wrote to memory of 4076	2712	Explorer.EXE	msiexec.exe
PID 2712 wrote to memory of 4076	2712	Explorer.EXE	msiexec.exe
PID 4076 wrote to memory of 4512	4076	msiexec.exe	cmd.exe
PID 4076 wrote to memory of 4512	4076	msiexec.exe	cmd.exe
PID 4076 wrote to memory of 4512	4076	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2712

C:\Users\Admin\AppData\Local\Temp\rrwq200123.exe
"C:\Users\Admin\AppData\Local\Temp\rrwq200123.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3716

C:\Users\Admin\AppData\Local\Temp\rrwq200123.exe
"C:\Users\Admin\AppData\Local\Temp\rrwq200123.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\rrwq200123.exe"
3⤵
PID:4512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nslEBF8.tmp\ylbzgkuxqsi.dll
MD5
51d6f1227b9a2e0b090c9d0dab9d4528

SHA1
43149a31386cd9613c5b0e8a218f1e7cc7f77af8

SHA256
23e80d01cf007b17f91366fb1866568f0385ff08767434728f209535d3452fdd

SHA512
b85fd793d0ddf2e96833b458fee64008ff13a863a4b9ba044bf916efc41947fdadc13cfb1deaa151d58c162d706e32226e14ea2a7ba82557eccff329c9e38afb

Download Submit
memory/2712-130-0x00000000068D0000-0x00000000069F7000-memory.dmp

Filesize
1.2MB

Download
memory/2712-121-0x00000000026C0000-0x0000000002797000-memory.dmp

Filesize
860KB

Download
memory/4072-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4072-117-0x000000000041F120-mapping.dmp

Download
memory/4072-120-0x00000000006E0000-0x00000000006F4000-memory.dmp

Filesize
80KB

Download
memory/4072-119-0x0000000000A00000-0x0000000000D20000-memory.dmp

Filesize
3.1MB

Download
memory/4076-122-0x0000000000000000-mapping.dmp

Download
memory/4076-124-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/4076-126-0x0000000004C90000-0x0000000004FB0000-memory.dmp

Filesize
3.1MB

Download
memory/4076-125-0x0000000000F50000-0x0000000000F62000-memory.dmp

Filesize
72KB

Download
memory/4076-127-0x0000000000E50000-0x0000000000E7F000-memory.dmp

Filesize
188KB

Download
memory/4076-129-0x0000000004B30000-0x0000000004BC3000-memory.dmp

Filesize
588KB

Download
memory/4076-123-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/4512-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads