formbook | 19f4dafb701e0d7f58c46397026e8d74b8d63fafe58caf3fa44739bb5bc41bb9

General

Target

mmhr56001.exe
Size

251KB
MD5

20516c4fdd5362027e7383befed47ed7
SHA1

3e58bfa088d92fad5b748723e9e5efde54ab3f99
SHA256

19f4dafb701e0d7f58c46397026e8d74b8d63fafe58caf3fa44739bb5bc41bb9
SHA512

f7d5d8005bba7a99f0b1f620acc106542cb5b2023ef61a3de2453a9e25ddb0b5b9f344766b6b182c4c5f398fb5f91ea401d0d907544bf409885f86e162421071

Score

10^/10

formbook rv9n rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2244-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2244-117-0x000000000041F120-mapping.dmp	formbook
behavioral2/memory/4052-124-0x00000000009B0000-0x00000000009DF000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

mmhr56001.exe

pid process

1572 mmhr56001.exe

pid	process
1572	mmhr56001.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

mmhr56001.exemmhr56001.execscript.exe

description	pid	process	target process
PID 1572 set thread context of 2244	1572	mmhr56001.exe	mmhr56001.exe
PID 2244 set thread context of 2552	2244	mmhr56001.exe	Explorer.EXE
PID 4052 set thread context of 2552	4052	cscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

mmhr56001.execscript.exe

pid	process
2244	mmhr56001.exe
2244	mmhr56001.exe
2244	mmhr56001.exe
2244	mmhr56001.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe
4052	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2552 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

mmhr56001.execscript.exe

pid process

2244 mmhr56001.exe
2244 mmhr56001.exe
2244 mmhr56001.exe
4052 cscript.exe
4052 cscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mmhr56001.execscript.exe

description pid process

Token: SeDebugPrivilege 2244 mmhr56001.exe
Token: SeDebugPrivilege 4052 cscript.exe

pid	process
2552	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2244	mmhr56001.exe
Token: SeDebugPrivilege	4052	cscript.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

mmhr56001.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 1572 wrote to memory of 2244	1572	mmhr56001.exe	mmhr56001.exe
PID 1572 wrote to memory of 2244	1572	mmhr56001.exe	mmhr56001.exe
PID 1572 wrote to memory of 2244	1572	mmhr56001.exe	mmhr56001.exe
PID 1572 wrote to memory of 2244	1572	mmhr56001.exe	mmhr56001.exe
PID 1572 wrote to memory of 2244	1572	mmhr56001.exe	mmhr56001.exe
PID 1572 wrote to memory of 2244	1572	mmhr56001.exe	mmhr56001.exe
PID 2552 wrote to memory of 4052	2552	Explorer.EXE	cscript.exe
PID 2552 wrote to memory of 4052	2552	Explorer.EXE	cscript.exe
PID 2552 wrote to memory of 4052	2552	Explorer.EXE	cscript.exe
PID 4052 wrote to memory of 4444	4052	cscript.exe	cmd.exe
PID 4052 wrote to memory of 4444	4052	cscript.exe	cmd.exe
PID 4052 wrote to memory of 4444	4052	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2552

C:\Users\Admin\AppData\Local\Temp\mmhr56001.exe
"C:\Users\Admin\AppData\Local\Temp\mmhr56001.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1572

C:\Users\Admin\AppData\Local\Temp\mmhr56001.exe
"C:\Users\Admin\AppData\Local\Temp\mmhr56001.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\mmhr56001.exe"
3⤵
PID:4444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nswD40B.tmp\vmmein.dll
MD5
82db187a22da883f403c64b9eca9eea0

SHA1
c0bd3fa3bb7116eb50fa593b7d5a40751c6092d3

SHA256
2add9d3b455a4fcc5b18bc64bf5c798761792db3c0b4124ce40ff4283d7d23b2

SHA512
7d6c35c546167eddf07296016f29dcfc10c6431f5d05bfe987289254c642665bf1fc0477ca356c501aa16fc5577a37b1f104aaab5b2eef8f21beb72f5c075fca

Download Submit
memory/2244-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2244-117-0x000000000041F120-mapping.dmp

Download
memory/2244-119-0x0000000000AB0000-0x0000000000DD0000-memory.dmp

Filesize
3.1MB

Download
memory/2244-120-0x00000000004E0000-0x000000000058E000-memory.dmp

Filesize
696KB

Download
memory/2552-128-0x0000000005330000-0x00000000054A3000-memory.dmp

Filesize
1.4MB

Download
memory/2552-121-0x0000000002BF0000-0x0000000002CB1000-memory.dmp

Filesize
772KB

Download
memory/4052-122-0x0000000000000000-mapping.dmp

Download
memory/4052-123-0x0000000000E60000-0x0000000000E87000-memory.dmp

Filesize
156KB

Download
memory/4052-126-0x0000000004CF0000-0x0000000005010000-memory.dmp

Filesize
3.1MB

Download
memory/4052-127-0x0000000004B60000-0x0000000004BF3000-memory.dmp

Filesize
588KB

Download
memory/4052-124-0x00000000009B0000-0x00000000009DF000-memory.dmp

Filesize
188KB

Download
memory/4444-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads