formbook | 9e29b8e60bf7a0e9f21ed8cca2d3e713b11e9be0ed6990e69ebf8ab5b5083c17

General

Target

Commander une image.exe
Size

680KB
MD5

b3e2d7ec66475428e995c4e706c4b0c5
SHA1

0d160fb47d47af61a0ca2378bd9a0844c561b39c
SHA256

9e29b8e60bf7a0e9f21ed8cca2d3e713b11e9be0ed6990e69ebf8ab5b5083c17
SHA512

2d4a73c9c7622b2ef9cfe640abfe542534866093b96a3c2ab49b3ddba8d6d54859dfcf58ba38ea2bebb9435a80123cce1cb3e48a292b4cdd7d65bef6a25be2a6

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/568-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/568-58-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/568-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1464-69-0x0000000000070000-0x000000000009F000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

668 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Commander une image.exe

pid process

828 Commander une image.exe

pid	process
668	cmd.exe

pid	process
828	Commander une image.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Commander une image.exeCommander une image.exewscript.exe

description	pid	process	target process
PID 828 set thread context of 568	828	Commander une image.exe	Commander une image.exe
PID 568 set thread context of 1392	568	Commander une image.exe	Explorer.EXE
PID 568 set thread context of 1392	568	Commander une image.exe	Explorer.EXE
PID 1464 set thread context of 1392	1464	wscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

Commander une image.exewscript.exe

pid	process
568	Commander une image.exe
568	Commander une image.exe
568	Commander une image.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe
1464	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Commander une image.exewscript.exe

pid process

568 Commander une image.exe
568 Commander une image.exe
568 Commander une image.exe
568 Commander une image.exe
1464 wscript.exe
1464 wscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Commander une image.exewscript.exe

description pid process

Token: SeDebugPrivilege 568 Commander une image.exe
Token: SeDebugPrivilege 1464 wscript.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
1392 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
1392 Explorer.EXE

pid	process
1392	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	568	Commander une image.exe
Token: SeDebugPrivilege	1464	wscript.exe

pid	process
1392	Explorer.EXE
1392	Explorer.EXE

pid	process
1392	Explorer.EXE
1392	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Commander une image.exeCommander une image.exewscript.exe

description	pid	process	target process
PID 828 wrote to memory of 568	828	Commander une image.exe	Commander une image.exe
PID 828 wrote to memory of 568	828	Commander une image.exe	Commander une image.exe
PID 828 wrote to memory of 568	828	Commander une image.exe	Commander une image.exe
PID 828 wrote to memory of 568	828	Commander une image.exe	Commander une image.exe
PID 828 wrote to memory of 568	828	Commander une image.exe	Commander une image.exe
PID 828 wrote to memory of 568	828	Commander une image.exe	Commander une image.exe
PID 828 wrote to memory of 568	828	Commander une image.exe	Commander une image.exe
PID 568 wrote to memory of 1464	568	Commander une image.exe	wscript.exe
PID 568 wrote to memory of 1464	568	Commander une image.exe	wscript.exe
PID 568 wrote to memory of 1464	568	Commander une image.exe	wscript.exe
PID 568 wrote to memory of 1464	568	Commander une image.exe	wscript.exe
PID 1464 wrote to memory of 668	1464	wscript.exe	cmd.exe
PID 1464 wrote to memory of 668	1464	wscript.exe	cmd.exe
PID 1464 wrote to memory of 668	1464	wscript.exe	cmd.exe
PID 1464 wrote to memory of 668	1464	wscript.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Commander une image.exe
"C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:828

C:\Users\Admin\AppData\Local\Temp\Commander une image.exe
"C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
4⤵
- Deletes itself
PID:668

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdF4FA.tmp\gkqvn.dll
MD5
fb96f242a6a27c728ec11534877114f0

SHA1
72180a0710a8dfb430c7dd71106e70736f8c7291

SHA256
1c7190343deb537619d4f4682646acfb0c3734b3f322fdce0a1e2a0676c9c292

SHA512
34b69e34e8ab46afc4bef93ec2093b6e09f06b29c32e913096ba0ae30d6cd8076ea4b52b5c58d14df3d35b5ce2ce718c960e6914950fe0e05982028492deb62d

Download Submit
memory/568-64-0x00000000003A0000-0x00000000003B5000-memory.dmp

Filesize
84KB

Download
memory/568-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/568-58-0x000000000041F200-mapping.dmp

Download
memory/568-60-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/568-61-0x0000000000360000-0x0000000000375000-memory.dmp

Filesize
84KB

Download
memory/568-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/668-67-0x0000000000000000-mapping.dmp

Download
memory/828-55-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1392-62-0x00000000071E0000-0x000000000733A000-memory.dmp

Filesize
1.4MB

Download
memory/1392-65-0x0000000007340000-0x00000000074C3000-memory.dmp

Filesize
1.5MB

Download
memory/1392-72-0x00000000060A0000-0x000000000615C000-memory.dmp

Filesize
752KB

Download
memory/1464-66-0x0000000000000000-mapping.dmp

Download
memory/1464-68-0x0000000000E10000-0x0000000000E36000-memory.dmp

Filesize
152KB

Download
memory/1464-69-0x0000000000070000-0x000000000009F000-memory.dmp

Filesize
188KB

Download
memory/1464-70-0x0000000002240000-0x0000000002543000-memory.dmp

Filesize
3.0MB

Download
memory/1464-71-0x0000000000990000-0x0000000000A24000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads