formbook | fe1d08713fdfde2e85f5da0e2ba784481a692c5fbd1298b6ed4936eaf0d42e81

General

Target

Nouvel ordre.exe
Size

443KB
MD5

4a61f81dbaa9b5ea6c3092f3db446d28
SHA1

51157d0665111e06b7a3267952cc4b1a99e0a1cf
SHA256

fe1d08713fdfde2e85f5da0e2ba784481a692c5fbd1298b6ed4936eaf0d42e81
SHA512

feb7ccbe69e870782d0e77fd81f5bb451e8d0df8992a54c7f248575faf26fc2453021fbd485e6a1fcdc7cd197d5b694e6f33816422dd8f8115bf341851d92c73

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/832-56-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/832-57-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/592-64-0x0000000000130000-0x000000000015F000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

340 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Nouvel ordre.exe

pid process

1360 Nouvel ordre.exe

pid	process
340	cmd.exe

pid	process
1360	Nouvel ordre.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Nouvel ordre.exeNouvel ordre.exewuapp.exe

description	pid	process	target process
PID 1360 set thread context of 832	1360	Nouvel ordre.exe	Nouvel ordre.exe
PID 832 set thread context of 1428	832	Nouvel ordre.exe	Explorer.EXE
PID 592 set thread context of 1428	592	wuapp.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

Nouvel ordre.exewuapp.exe

pid	process
832	Nouvel ordre.exe
832	Nouvel ordre.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe
592	wuapp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1428 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Nouvel ordre.exewuapp.exe

pid process

832 Nouvel ordre.exe
832 Nouvel ordre.exe
832 Nouvel ordre.exe
592 wuapp.exe
592 wuapp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Nouvel ordre.exewuapp.exe

description pid process

Token: SeDebugPrivilege 832 Nouvel ordre.exe
Token: SeDebugPrivilege 592 wuapp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1428 Explorer.EXE
1428 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1428 Explorer.EXE
1428 Explorer.EXE

pid	process
1428	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	832	Nouvel ordre.exe
Token: SeDebugPrivilege	592	wuapp.exe

pid	process
1428	Explorer.EXE
1428	Explorer.EXE

pid	process
1428	Explorer.EXE
1428	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Nouvel ordre.exeExplorer.EXEwuapp.exe

description	pid	process	target process
PID 1360 wrote to memory of 832	1360	Nouvel ordre.exe	Nouvel ordre.exe
PID 1360 wrote to memory of 832	1360	Nouvel ordre.exe	Nouvel ordre.exe
PID 1360 wrote to memory of 832	1360	Nouvel ordre.exe	Nouvel ordre.exe
PID 1360 wrote to memory of 832	1360	Nouvel ordre.exe	Nouvel ordre.exe
PID 1360 wrote to memory of 832	1360	Nouvel ordre.exe	Nouvel ordre.exe
PID 1360 wrote to memory of 832	1360	Nouvel ordre.exe	Nouvel ordre.exe
PID 1360 wrote to memory of 832	1360	Nouvel ordre.exe	Nouvel ordre.exe
PID 1428 wrote to memory of 592	1428	Explorer.EXE	wuapp.exe
PID 1428 wrote to memory of 592	1428	Explorer.EXE	wuapp.exe
PID 1428 wrote to memory of 592	1428	Explorer.EXE	wuapp.exe
PID 1428 wrote to memory of 592	1428	Explorer.EXE	wuapp.exe
PID 1428 wrote to memory of 592	1428	Explorer.EXE	wuapp.exe
PID 1428 wrote to memory of 592	1428	Explorer.EXE	wuapp.exe
PID 1428 wrote to memory of 592	1428	Explorer.EXE	wuapp.exe
PID 592 wrote to memory of 340	592	wuapp.exe	cmd.exe
PID 592 wrote to memory of 340	592	wuapp.exe	cmd.exe
PID 592 wrote to memory of 340	592	wuapp.exe	cmd.exe
PID 592 wrote to memory of 340	592	wuapp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1360

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:828

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
- Deletes itself
PID:340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy5439.tmp\rlfw.dll
MD5
18c00088f81c94a4a8bbdbdaead3499f

SHA1
900e26def38cf36e375c45617c3f15f1b74712d2

SHA256
5958f961c7706e1bfac20779e52bae7be4f271f9fb0259c84973ecdadfcbeeed

SHA512
b740360ee046270cad4be28d28c27876b5063c2a73ff22060a19d9e8dcbf5616e63ba9b26325d618ba8c5cacdfd18a3a9a151ca2404bc6d3017d10ee09e0afb4

Download Submit
memory/340-65-0x0000000000000000-mapping.dmp

Download
memory/592-62-0x0000000000000000-mapping.dmp

Download
memory/592-67-0x0000000000900000-0x0000000000994000-memory.dmp

Filesize
592KB

Download
memory/592-66-0x0000000000A90000-0x0000000000D93000-memory.dmp

Filesize
3.0MB

Download
memory/592-64-0x0000000000130000-0x000000000015F000-memory.dmp

Filesize
188KB

Download
memory/592-63-0x0000000000F20000-0x0000000000F2B000-memory.dmp

Filesize
44KB

Download
memory/832-57-0x000000000041F200-mapping.dmp

Download
memory/832-59-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download
memory/832-60-0x00000000002C0000-0x00000000002D5000-memory.dmp

Filesize
84KB

Download
memory/832-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1360-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1428-61-0x00000000068E0000-0x0000000006A1B000-memory.dmp

Filesize
1.2MB

Download
memory/1428-68-0x0000000007BE0000-0x0000000007D3F000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads