formbook | fe1d08713fdfde2e85f5da0e2ba784481a692c5fbd1298b6ed4936eaf0d42e81

General

Target

Nouvel ordre.exe
Size

443KB
MD5

4a61f81dbaa9b5ea6c3092f3db446d28
SHA1

51157d0665111e06b7a3267952cc4b1a99e0a1cf
SHA256

fe1d08713fdfde2e85f5da0e2ba784481a692c5fbd1298b6ed4936eaf0d42e81
SHA512

feb7ccbe69e870782d0e77fd81f5bb451e8d0df8992a54c7f248575faf26fc2453021fbd485e6a1fcdc7cd197d5b694e6f33816422dd8f8115bf341851d92c73

Score

10^/10

formbook dn7r rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/700-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/700-58-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/1644-65-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

848 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Nouvel ordre.exe

pid process

1588 Nouvel ordre.exe

pid	process
848	cmd.exe

pid	process
1588	Nouvel ordre.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Nouvel ordre.exeNouvel ordre.exesystray.exe

description	pid	process	target process
PID 1588 set thread context of 700	1588	Nouvel ordre.exe	Nouvel ordre.exe
PID 700 set thread context of 1400	700	Nouvel ordre.exe	Explorer.EXE
PID 1644 set thread context of 1400	1644	systray.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Nouvel ordre.exesystray.exe

pid	process
700	Nouvel ordre.exe
700	Nouvel ordre.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe
1644	systray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Nouvel ordre.exesystray.exe

pid process

700 Nouvel ordre.exe
700 Nouvel ordre.exe
700 Nouvel ordre.exe
1644 systray.exe
1644 systray.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Nouvel ordre.exesystray.exe

description pid process

Token: SeDebugPrivilege 700 Nouvel ordre.exe
Token: SeDebugPrivilege 1644 systray.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE

pid	process
1400	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	700	Nouvel ordre.exe
Token: SeDebugPrivilege	1644	systray.exe

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Nouvel ordre.exeExplorer.EXEsystray.exe

description	pid	process	target process
PID 1588 wrote to memory of 700	1588	Nouvel ordre.exe	Nouvel ordre.exe
PID 1588 wrote to memory of 700	1588	Nouvel ordre.exe	Nouvel ordre.exe
PID 1588 wrote to memory of 700	1588	Nouvel ordre.exe	Nouvel ordre.exe
PID 1588 wrote to memory of 700	1588	Nouvel ordre.exe	Nouvel ordre.exe
PID 1588 wrote to memory of 700	1588	Nouvel ordre.exe	Nouvel ordre.exe
PID 1588 wrote to memory of 700	1588	Nouvel ordre.exe	Nouvel ordre.exe
PID 1588 wrote to memory of 700	1588	Nouvel ordre.exe	Nouvel ordre.exe
PID 1400 wrote to memory of 1644	1400	Explorer.EXE	systray.exe
PID 1400 wrote to memory of 1644	1400	Explorer.EXE	systray.exe
PID 1400 wrote to memory of 1644	1400	Explorer.EXE	systray.exe
PID 1400 wrote to memory of 1644	1400	Explorer.EXE	systray.exe
PID 1644 wrote to memory of 848	1644	systray.exe	cmd.exe
PID 1644 wrote to memory of 848	1644	systray.exe	cmd.exe
PID 1644 wrote to memory of 848	1644	systray.exe	cmd.exe
PID 1644 wrote to memory of 848	1644	systray.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
- Deletes itself
PID:848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiCA23.tmp\rlfw.dll
MD5
18c00088f81c94a4a8bbdbdaead3499f

SHA1
900e26def38cf36e375c45617c3f15f1b74712d2

SHA256
5958f961c7706e1bfac20779e52bae7be4f271f9fb0259c84973ecdadfcbeeed

SHA512
b740360ee046270cad4be28d28c27876b5063c2a73ff22060a19d9e8dcbf5616e63ba9b26325d618ba8c5cacdfd18a3a9a151ca2404bc6d3017d10ee09e0afb4

Download Submit
memory/700-61-0x00000000002C0000-0x00000000002D5000-memory.dmp

Filesize
84KB

Download
memory/700-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/700-58-0x000000000041F200-mapping.dmp

Download
memory/700-59-0x00000000006E0000-0x00000000009E3000-memory.dmp

Filesize
3.0MB

Download
memory/848-66-0x0000000000000000-mapping.dmp

Download
memory/1400-62-0x00000000072F0000-0x000000000747F000-memory.dmp

Filesize
1.6MB

Download
memory/1400-69-0x0000000004B50000-0x0000000004BEF000-memory.dmp

Filesize
636KB

Download
memory/1588-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download
memory/1644-63-0x0000000000000000-mapping.dmp

Download
memory/1644-64-0x0000000000820000-0x0000000000825000-memory.dmp

Filesize
20KB

Download
memory/1644-65-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1644-67-0x0000000001DC0000-0x00000000020C3000-memory.dmp

Filesize
3.0MB

Download
memory/1644-68-0x0000000001CA0000-0x0000000001D34000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads