formbook | 25439bd1af262e2afc1fffd901a00d423a77b1da0a6b5c23302e4744b5e0116a

General

Target

online_pdf.com.exe
Size

491KB
MD5

3cdbec5b22be037209b38ea585de4a50
SHA1

f904a637406954b6d613152a0bbebfccc514dc3e
SHA256

25439bd1af262e2afc1fffd901a00d423a77b1da0a6b5c23302e4744b5e0116a
SHA512

da8fe366ca35b4eea7c998e0456baa6a5bff1cdca014564e0803823b89bfa5c55206e7f83dbfb6b8e38963ff194e9454001ac00c91cdd37c47801b17ce1aae96

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2660-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2660-117-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/3340-125-0x0000000000CF0000-0x0000000000D1F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

online_pdf.com.exe

pid process

2732 online_pdf.com.exe

pid	process
2732	online_pdf.com.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

online_pdf.com.exeonline_pdf.com.execmd.exe

description	pid	process	target process
PID 2732 set thread context of 2660	2732	online_pdf.com.exe	online_pdf.com.exe
PID 2660 set thread context of 3020	2660	online_pdf.com.exe	Explorer.EXE
PID 3340 set thread context of 3020	3340	cmd.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

online_pdf.com.execmd.exe

pid	process
2660	online_pdf.com.exe
2660	online_pdf.com.exe
2660	online_pdf.com.exe
2660	online_pdf.com.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe
3340	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3020 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

online_pdf.com.execmd.exe

pid process

2660 online_pdf.com.exe
2660 online_pdf.com.exe
2660 online_pdf.com.exe
3340 cmd.exe
3340 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

online_pdf.com.execmd.exe

description pid process

Token: SeDebugPrivilege 2660 online_pdf.com.exe
Token: SeDebugPrivilege 3340 cmd.exe

pid	process
3020	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2660	online_pdf.com.exe
Token: SeDebugPrivilege	3340	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

online_pdf.com.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 2732 wrote to memory of 2660	2732	online_pdf.com.exe	online_pdf.com.exe
PID 2732 wrote to memory of 2660	2732	online_pdf.com.exe	online_pdf.com.exe
PID 2732 wrote to memory of 2660	2732	online_pdf.com.exe	online_pdf.com.exe
PID 2732 wrote to memory of 2660	2732	online_pdf.com.exe	online_pdf.com.exe
PID 2732 wrote to memory of 2660	2732	online_pdf.com.exe	online_pdf.com.exe
PID 2732 wrote to memory of 2660	2732	online_pdf.com.exe	online_pdf.com.exe
PID 3020 wrote to memory of 3340	3020	Explorer.EXE	cmd.exe
PID 3020 wrote to memory of 3340	3020	Explorer.EXE	cmd.exe
PID 3020 wrote to memory of 3340	3020	Explorer.EXE	cmd.exe
PID 3340 wrote to memory of 2640	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 2640	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 2640	3340	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe
"C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe
"C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe"
3⤵
PID:2640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsqDEE8.tmp\apqan.dll
MD5
3fd39c9847bb4b594952834b7fdf24e6

SHA1
96f52b1cc8dc965984063b745b801d3bba95ff27

SHA256
5f16dc9d03fc218e2ec3bbe921603f5aab9377747f6bb7440435e56f6dbde816

SHA512
3a899c04bf6cebd9ac495941cb82a37bfc6789eb073a4a9b31602213542d6e7f66111ddf4d9970fba8149a1e9adf8aea6f272e7716b3f23d67beafd677d38305

Download Submit
memory/2640-123-0x0000000000000000-mapping.dmp

Download
memory/2660-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2660-117-0x000000000041F200-mapping.dmp

Download
memory/2660-120-0x00000000009D0000-0x00000000009E5000-memory.dmp

Filesize
84KB

Download
memory/2660-119-0x0000000000AD0000-0x0000000000DF0000-memory.dmp

Filesize
3.1MB

Download
memory/3020-128-0x0000000005F40000-0x0000000006052000-memory.dmp

Filesize
1.1MB

Download
memory/3020-121-0x0000000006430000-0x00000000065CE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-122-0x0000000000000000-mapping.dmp

Download
memory/3340-125-0x0000000000CF0000-0x0000000000D1F000-memory.dmp

Filesize
188KB

Download
memory/3340-126-0x00000000037A0000-0x0000000003AC0000-memory.dmp

Filesize
3.1MB

Download
memory/3340-127-0x0000000003670000-0x0000000003704000-memory.dmp

Filesize
592KB

Download
memory/3340-124-0x0000000000DE0000-0x0000000000E39000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads