formbook | e5748da0c2f2dc145c6f8785ff4542db53c3c47e545b8c7ee241fc54124af62d

General

Target

order_pdf.com.exe
Size

499KB
MD5

ef3e99af8be507c22eed868bb067835b
SHA1

1426535a0c855bb41b15de2d9b06365791088569
SHA256

e5748da0c2f2dc145c6f8785ff4542db53c3c47e545b8c7ee241fc54124af62d
SHA512

3110ae49973abddf416ee0018a889612cbfb2ea5f2d3214cc97d72d2c1af3a1a9130e996867c58fda3fccdb8a7aa64e551f6c2bc89922d4f741996289512c461

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/752-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/752-117-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/4116-125-0x0000000000820000-0x000000000084F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

order_pdf.com.exe

pid process

3576 order_pdf.com.exe

pid	process
3576	order_pdf.com.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

order_pdf.com.exeorder_pdf.com.exerundll32.exe

description	pid	process	target process
PID 3576 set thread context of 752	3576	order_pdf.com.exe	order_pdf.com.exe
PID 752 set thread context of 2872	752	order_pdf.com.exe	Explorer.EXE
PID 4116 set thread context of 2872	4116	rundll32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

order_pdf.com.exerundll32.exe

pid	process
752	order_pdf.com.exe
752	order_pdf.com.exe
752	order_pdf.com.exe
752	order_pdf.com.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe
4116	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2872 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

order_pdf.com.exerundll32.exe

pid process

752 order_pdf.com.exe
752 order_pdf.com.exe
752 order_pdf.com.exe
4116 rundll32.exe
4116 rundll32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

order_pdf.com.exerundll32.exe

description pid process

Token: SeDebugPrivilege 752 order_pdf.com.exe
Token: SeDebugPrivilege 4116 rundll32.exe

pid	process
2872	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	752	order_pdf.com.exe
Token: SeDebugPrivilege	4116	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

order_pdf.com.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 3576 wrote to memory of 752	3576	order_pdf.com.exe	order_pdf.com.exe
PID 3576 wrote to memory of 752	3576	order_pdf.com.exe	order_pdf.com.exe
PID 3576 wrote to memory of 752	3576	order_pdf.com.exe	order_pdf.com.exe
PID 3576 wrote to memory of 752	3576	order_pdf.com.exe	order_pdf.com.exe
PID 3576 wrote to memory of 752	3576	order_pdf.com.exe	order_pdf.com.exe
PID 3576 wrote to memory of 752	3576	order_pdf.com.exe	order_pdf.com.exe
PID 2872 wrote to memory of 4116	2872	Explorer.EXE	rundll32.exe
PID 2872 wrote to memory of 4116	2872	Explorer.EXE	rundll32.exe
PID 2872 wrote to memory of 4116	2872	Explorer.EXE	rundll32.exe
PID 4116 wrote to memory of 3224	4116	rundll32.exe	cmd.exe
PID 4116 wrote to memory of 3224	4116	rundll32.exe	cmd.exe
PID 4116 wrote to memory of 3224	4116	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Local\Temp\order_pdf.com.exe
"C:\Users\Admin\AppData\Local\Temp\order_pdf.com.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Local\Temp\order_pdf.com.exe
"C:\Users\Admin\AppData\Local\Temp\order_pdf.com.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\order_pdf.com.exe"
3⤵
PID:3224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsrC788.tmp\ovyiydb.dll
MD5
2615a818a234eacf0e7101587d797289

SHA1
62508907384c8582538a7ab171b5f59537bb3bdc

SHA256
df04c7baca283a66888638765b974c2dba95a28c493a55a06a301c83619a5b94

SHA512
65706c804615557bb226832b623c41593ba3ff492fc646f67c7d1b3728bd7152445207da5abc07dc2062af95ccbdfefc56f12ca3059b3f4b71d3ee58a9e805e0

Download Submit
memory/752-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/752-117-0x000000000041F200-mapping.dmp

Download
memory/752-120-0x0000000000DE0000-0x0000000000DF5000-memory.dmp

Filesize
84KB

Download
memory/752-119-0x0000000000AA0000-0x0000000000DC0000-memory.dmp

Filesize
3.1MB

Download
memory/2872-128-0x00000000024A0000-0x000000000259C000-memory.dmp

Filesize
1008KB

Download
memory/2872-121-0x00000000005E0000-0x0000000000698000-memory.dmp

Filesize
736KB

Download
memory/3224-123-0x0000000000000000-mapping.dmp

Download
memory/4116-122-0x0000000000000000-mapping.dmp

Download
memory/4116-125-0x0000000000820000-0x000000000084F000-memory.dmp

Filesize
188KB

Download
memory/4116-126-0x0000000004660000-0x0000000004980000-memory.dmp

Filesize
3.1MB

Download
memory/4116-127-0x0000000004560000-0x00000000045F4000-memory.dmp

Filesize
592KB

Download
memory/4116-124-0x00000000010A0000-0x00000000010B3000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads