formbook | fe1d08713fdfde2e85f5da0e2ba784481a692c5fbd1298b6ed4936eaf0d42e81

General

Target

Nouvel ordre.exe
Size

443KB
MD5

4a61f81dbaa9b5ea6c3092f3db446d28
SHA1

51157d0665111e06b7a3267952cc4b1a99e0a1cf
SHA256

fe1d08713fdfde2e85f5da0e2ba784481a692c5fbd1298b6ed4936eaf0d42e81
SHA512

feb7ccbe69e870782d0e77fd81f5bb451e8d0df8992a54c7f248575faf26fc2453021fbd485e6a1fcdc7cd197d5b694e6f33816422dd8f8115bf341851d92c73

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3128-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3128-117-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/2760-127-0x0000000002C80000-0x0000000002CAF000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

Nouvel ordre.exe

pid process

2636 Nouvel ordre.exe

pid	process
2636	Nouvel ordre.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Nouvel ordre.exeNouvel ordre.exemsiexec.exe

description	pid	process	target process
PID 2636 set thread context of 3128	2636	Nouvel ordre.exe	Nouvel ordre.exe
PID 3128 set thread context of 3020	3128	Nouvel ordre.exe	Explorer.EXE
PID 2760 set thread context of 3020	2760	msiexec.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Nouvel ordre.exemsiexec.exe

pid	process
3128	Nouvel ordre.exe
3128	Nouvel ordre.exe
3128	Nouvel ordre.exe
3128	Nouvel ordre.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe
2760	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3020 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Nouvel ordre.exemsiexec.exe

pid process

3128 Nouvel ordre.exe
3128 Nouvel ordre.exe
3128 Nouvel ordre.exe
2760 msiexec.exe
2760 msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Nouvel ordre.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 3128 Nouvel ordre.exe
Token: SeDebugPrivilege 2760 msiexec.exe

pid	process
3020	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3128	Nouvel ordre.exe
Token: SeDebugPrivilege	2760	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Nouvel ordre.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 2636 wrote to memory of 3128	2636	Nouvel ordre.exe	Nouvel ordre.exe
PID 2636 wrote to memory of 3128	2636	Nouvel ordre.exe	Nouvel ordre.exe
PID 2636 wrote to memory of 3128	2636	Nouvel ordre.exe	Nouvel ordre.exe
PID 2636 wrote to memory of 3128	2636	Nouvel ordre.exe	Nouvel ordre.exe
PID 2636 wrote to memory of 3128	2636	Nouvel ordre.exe	Nouvel ordre.exe
PID 2636 wrote to memory of 3128	2636	Nouvel ordre.exe	Nouvel ordre.exe
PID 3020 wrote to memory of 2760	3020	Explorer.EXE	msiexec.exe
PID 3020 wrote to memory of 2760	3020	Explorer.EXE	msiexec.exe
PID 3020 wrote to memory of 2760	3020	Explorer.EXE	msiexec.exe
PID 2760 wrote to memory of 4072	2760	msiexec.exe	cmd.exe
PID 2760 wrote to memory of 4072	2760	msiexec.exe	cmd.exe
PID 2760 wrote to memory of 4072	2760	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2636

C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
"C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
3⤵
PID:4072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nscBD37.tmp\rlfw.dll
MD5
18c00088f81c94a4a8bbdbdaead3499f

SHA1
900e26def38cf36e375c45617c3f15f1b74712d2

SHA256
5958f961c7706e1bfac20779e52bae7be4f271f9fb0259c84973ecdadfcbeeed

SHA512
b740360ee046270cad4be28d28c27876b5063c2a73ff22060a19d9e8dcbf5616e63ba9b26325d618ba8c5cacdfd18a3a9a151ca2404bc6d3017d10ee09e0afb4

Download Submit
memory/2760-126-0x0000000000C00000-0x0000000000C12000-memory.dmp

Filesize
72KB

Download
memory/2760-129-0x0000000004B70000-0x0000000004C04000-memory.dmp

Filesize
592KB

Download
memory/2760-128-0x0000000004D00000-0x0000000005020000-memory.dmp

Filesize
3.1MB

Download
memory/2760-122-0x0000000000000000-mapping.dmp

Download
memory/2760-124-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/2760-123-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/2760-127-0x0000000002C80000-0x0000000002CAF000-memory.dmp

Filesize
188KB

Download
memory/3020-130-0x0000000000520000-0x00000000005C5000-memory.dmp

Filesize
660KB

Download
memory/3020-121-0x00000000024C0000-0x00000000025BE000-memory.dmp

Filesize
1016KB

Download
memory/3128-118-0x0000000000BB0000-0x0000000000ED0000-memory.dmp

Filesize
3.1MB

Download
memory/3128-120-0x00000000006E0000-0x00000000006F5000-memory.dmp

Filesize
84KB

Download
memory/3128-117-0x000000000041F200-mapping.dmp

Download
memory/3128-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4072-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads