formbook | fe1d08713fdfde2e85f5da0e2ba784481a692c5fbd1298b6ed4936eaf0d42e81

General

Target

Nouvel ordre.exe
Size

443KB
MD5

4a61f81dbaa9b5ea6c3092f3db446d28
SHA1

51157d0665111e06b7a3267952cc4b1a99e0a1cf
SHA256

fe1d08713fdfde2e85f5da0e2ba784481a692c5fbd1298b6ed4936eaf0d42e81
SHA512

feb7ccbe69e870782d0e77fd81f5bb451e8d0df8992a54c7f248575faf26fc2453021fbd485e6a1fcdc7cd197d5b694e6f33816422dd8f8115bf341851d92c73

Score

10^/10

formbook dn7r rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3896-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3896-117-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/3440-124-0x0000000000540000-0x000000000056F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

Nouvel ordre.exe

pid process

2856 Nouvel ordre.exe

pid	process
2856	Nouvel ordre.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Nouvel ordre.exeNouvel ordre.execscript.exe

description	pid	process	target process
PID 2856 set thread context of 3896	2856	Nouvel ordre.exe	Nouvel ordre.exe
PID 3896 set thread context of 2872	3896	Nouvel ordre.exe	Explorer.EXE
PID 3440 set thread context of 2872	3440	cscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Nouvel ordre.execscript.exe

pid	process
3896	Nouvel ordre.exe
3896	Nouvel ordre.exe
3896	Nouvel ordre.exe
3896	Nouvel ordre.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe
3440	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2872 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Nouvel ordre.execscript.exe

pid process

3896 Nouvel ordre.exe
3896 Nouvel ordre.exe
3896 Nouvel ordre.exe
3440 cscript.exe
3440 cscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Nouvel ordre.execscript.exe

description pid process

Token: SeDebugPrivilege 3896 Nouvel ordre.exe
Token: SeDebugPrivilege 3440 cscript.exe

pid	process
2872	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3896	Nouvel ordre.exe
Token: SeDebugPrivilege	3440	cscript.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Nouvel ordre.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 2856 wrote to memory of 3896	2856	Nouvel ordre.exe	Nouvel ordre.exe
PID 2856 wrote to memory of 3896	2856	Nouvel ordre.exe	Nouvel ordre.exe
PID 2856 wrote to memory of 3896	2856	Nouvel ordre.exe	Nouvel ordre.exe
PID 2856 wrote to memory of 3896	2856	Nouvel ordre.exe	Nouvel ordre.exe
PID 2856 wrote to memory of 3896	2856	Nouvel ordre.exe	Nouvel ordre.exe
PID 2856 wrote to memory of 3896	2856	Nouvel ordre.exe	Nouvel ordre.exe
PID 2872 wrote to memory of 3440	2872	Explorer.EXE	cscript.exe
PID 2872 wrote to memory of 3440	2872	Explorer.EXE	cscript.exe
PID 2872 wrote to memory of 3440	2872	Explorer.EXE	cscript.exe
PID 3440 wrote to memory of 1016	3440	cscript.exe	cmd.exe
PID 3440 wrote to memory of 1016	3440	cscript.exe	cmd.exe
PID 3440 wrote to memory of 1016	3440	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2856

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
PID:1016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsjDB4E.tmp\rlfw.dll
MD5
18c00088f81c94a4a8bbdbdaead3499f

SHA1
900e26def38cf36e375c45617c3f15f1b74712d2

SHA256
5958f961c7706e1bfac20779e52bae7be4f271f9fb0259c84973ecdadfcbeeed

SHA512
b740360ee046270cad4be28d28c27876b5063c2a73ff22060a19d9e8dcbf5616e63ba9b26325d618ba8c5cacdfd18a3a9a151ca2404bc6d3017d10ee09e0afb4

Download Submit
memory/1016-126-0x0000000000000000-mapping.dmp

Download
memory/2872-121-0x0000000004AE0000-0x0000000004C8C000-memory.dmp

Filesize
1.7MB

Download
memory/2872-128-0x0000000000450000-0x00000000004F9000-memory.dmp

Filesize
676KB

Download
memory/3440-125-0x00000000046C0000-0x00000000049E0000-memory.dmp

Filesize
3.1MB

Download
memory/3440-122-0x0000000000000000-mapping.dmp

Download
memory/3440-123-0x0000000000DC0000-0x0000000000DE7000-memory.dmp

Filesize
156KB

Download
memory/3440-124-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/3440-127-0x0000000004420000-0x00000000044B4000-memory.dmp

Filesize
592KB

Download
memory/3896-120-0x0000000000CF0000-0x0000000000D05000-memory.dmp

Filesize
84KB

Download
memory/3896-119-0x0000000000990000-0x0000000000CB0000-memory.dmp

Filesize
3.1MB

Download
memory/3896-117-0x000000000041F200-mapping.dmp

Download
memory/3896-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads