formbook | f10c64e049fdcd6ac4bbebf138646aa5628a4a8b34fe8d8efac95d6c387e557a

General

Target

Commander une image.exe
Size

680KB
MD5

b3e2d7ec66475428e995c4e706c4b0c5
SHA1

0d160fb47d47af61a0ca2378bd9a0844c561b39c
SHA256

9e29b8e60bf7a0e9f21ed8cca2d3e713b11e9be0ed6990e69ebf8ab5b5083c17
SHA512

2d4a73c9c7622b2ef9cfe640abfe542534866093b96a3c2ab49b3ddba8d6d54859dfcf58ba38ea2bebb9435a80123cce1cb3e48a292b4cdd7d65bef6a25be2a6

Score

10^/10

formbook dn7r rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1424-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1424-58-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/568-66-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1188 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Commander une image.exe

pid process

1432 Commander une image.exe

pid	process
1188	cmd.exe

pid	process
1432	Commander une image.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Commander une image.exeCommander une image.execmstp.exe

description	pid	process	target process
PID 1432 set thread context of 1424	1432	Commander une image.exe	Commander une image.exe
PID 1424 set thread context of 1384	1424	Commander une image.exe	Explorer.EXE
PID 568 set thread context of 1384	568	cmstp.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

Commander une image.execmstp.exe

pid	process
1424	Commander une image.exe
1424	Commander une image.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe
568	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1384 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Commander une image.execmstp.exe

pid process

1424 Commander une image.exe
1424 Commander une image.exe
1424 Commander une image.exe
568 cmstp.exe
568 cmstp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Commander une image.execmstp.exe

description pid process

Token: SeDebugPrivilege 1424 Commander une image.exe
Token: SeDebugPrivilege 568 cmstp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1384 Explorer.EXE
1384 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1384 Explorer.EXE
1384 Explorer.EXE

pid	process
1384	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1424	Commander une image.exe
Token: SeDebugPrivilege	568	cmstp.exe

pid	process
1384	Explorer.EXE
1384	Explorer.EXE

pid	process
1384	Explorer.EXE
1384	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Commander une image.exeExplorer.EXEcmstp.exe

description	pid	process	target process
PID 1432 wrote to memory of 1424	1432	Commander une image.exe	Commander une image.exe
PID 1432 wrote to memory of 1424	1432	Commander une image.exe	Commander une image.exe
PID 1432 wrote to memory of 1424	1432	Commander une image.exe	Commander une image.exe
PID 1432 wrote to memory of 1424	1432	Commander une image.exe	Commander une image.exe
PID 1432 wrote to memory of 1424	1432	Commander une image.exe	Commander une image.exe
PID 1432 wrote to memory of 1424	1432	Commander une image.exe	Commander une image.exe
PID 1432 wrote to memory of 1424	1432	Commander une image.exe	Commander une image.exe
PID 1384 wrote to memory of 568	1384	Explorer.EXE	cmstp.exe
PID 1384 wrote to memory of 568	1384	Explorer.EXE	cmstp.exe
PID 1384 wrote to memory of 568	1384	Explorer.EXE	cmstp.exe
PID 1384 wrote to memory of 568	1384	Explorer.EXE	cmstp.exe
PID 1384 wrote to memory of 568	1384	Explorer.EXE	cmstp.exe
PID 1384 wrote to memory of 568	1384	Explorer.EXE	cmstp.exe
PID 1384 wrote to memory of 568	1384	Explorer.EXE	cmstp.exe
PID 568 wrote to memory of 1188	568	cmstp.exe	cmd.exe
PID 568 wrote to memory of 1188	568	cmstp.exe	cmd.exe
PID 568 wrote to memory of 1188	568	cmstp.exe	cmd.exe
PID 568 wrote to memory of 1188	568	cmstp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384

C:\Users\Admin\AppData\Local\Temp\Commander une image.exe
"C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1432

C:\Users\Admin\AppData\Local\Temp\Commander une image.exe
"C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1604

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1396

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
3⤵
- Deletes itself
PID:1188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsnDD74.tmp\gkqvn.dll
MD5
fb96f242a6a27c728ec11534877114f0

SHA1
72180a0710a8dfb430c7dd71106e70736f8c7291

SHA256
1c7190343deb537619d4f4682646acfb0c3734b3f322fdce0a1e2a0676c9c292

SHA512
34b69e34e8ab46afc4bef93ec2093b6e09f06b29c32e913096ba0ae30d6cd8076ea4b52b5c58d14df3d35b5ce2ce718c960e6914950fe0e05982028492deb62d

Download Submit
memory/568-63-0x0000000000000000-mapping.dmp

Download
memory/568-69-0x0000000001E60000-0x0000000001EF4000-memory.dmp

Filesize
592KB

Download
memory/568-67-0x0000000002090000-0x0000000002393000-memory.dmp

Filesize
3.0MB

Download
memory/568-65-0x0000000000680000-0x0000000000698000-memory.dmp

Filesize
96KB

Download
memory/568-66-0x0000000000090000-0x00000000000BF000-memory.dmp

Filesize
188KB

Download
memory/1188-68-0x0000000000000000-mapping.dmp

Download
memory/1384-62-0x00000000051E0000-0x00000000052E9000-memory.dmp

Filesize
1.0MB

Download
memory/1384-70-0x0000000007B20000-0x0000000007CA9000-memory.dmp

Filesize
1.5MB

Download
memory/1424-61-0x00000000002D0000-0x00000000002E5000-memory.dmp

Filesize
84KB

Download
memory/1424-60-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/1424-58-0x000000000041F200-mapping.dmp

Download
memory/1424-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1432-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads