formbook | f10c64e049fdcd6ac4bbebf138646aa5628a4a8b34fe8d8efac95d6c387e557a

General

Target

Commander une image.exe
Size

680KB
MD5

b3e2d7ec66475428e995c4e706c4b0c5
SHA1

0d160fb47d47af61a0ca2378bd9a0844c561b39c
SHA256

9e29b8e60bf7a0e9f21ed8cca2d3e713b11e9be0ed6990e69ebf8ab5b5083c17
SHA512

2d4a73c9c7622b2ef9cfe640abfe542534866093b96a3c2ab49b3ddba8d6d54859dfcf58ba38ea2bebb9435a80123cce1cb3e48a292b4cdd7d65bef6a25be2a6

Score

10^/10

formbook dn7r rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4260-119-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4260-120-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/4268-128-0x0000000002F90000-0x0000000002FBF000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

Commander une image.exe

pid process

4204 Commander une image.exe

pid	process
4204	Commander une image.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Commander une image.exeCommander une image.exehelp.exe

description	pid	process	target process
PID 4204 set thread context of 4260	4204	Commander une image.exe	Commander une image.exe
PID 4260 set thread context of 2880	4260	Commander une image.exe	Explorer.EXE
PID 4268 set thread context of 2880	4268	help.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

Commander une image.exehelp.exe

pid	process
4260	Commander une image.exe
4260	Commander une image.exe
4260	Commander une image.exe
4260	Commander une image.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe
4268	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2880 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Commander une image.exehelp.exe

pid process

4260 Commander une image.exe
4260 Commander une image.exe
4260 Commander une image.exe
4268 help.exe
4268 help.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Commander une image.exehelp.exe

description pid process

Token: SeDebugPrivilege 4260 Commander une image.exe
Token: SeDebugPrivilege 4268 help.exe

pid	process
2880	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	4260	Commander une image.exe
Token: SeDebugPrivilege	4268	help.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Commander une image.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 4204 wrote to memory of 4260	4204	Commander une image.exe	Commander une image.exe
PID 4204 wrote to memory of 4260	4204	Commander une image.exe	Commander une image.exe
PID 4204 wrote to memory of 4260	4204	Commander une image.exe	Commander une image.exe
PID 4204 wrote to memory of 4260	4204	Commander une image.exe	Commander une image.exe
PID 4204 wrote to memory of 4260	4204	Commander une image.exe	Commander une image.exe
PID 4204 wrote to memory of 4260	4204	Commander une image.exe	Commander une image.exe
PID 2880 wrote to memory of 4268	2880	Explorer.EXE	help.exe
PID 2880 wrote to memory of 4268	2880	Explorer.EXE	help.exe
PID 2880 wrote to memory of 4268	2880	Explorer.EXE	help.exe
PID 4268 wrote to memory of 4380	4268	help.exe	cmd.exe
PID 4268 wrote to memory of 4380	4268	help.exe	cmd.exe
PID 4268 wrote to memory of 4380	4268	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2880

C:\Users\Admin\AppData\Local\Temp\Commander une image.exe
"C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4204

C:\Users\Admin\AppData\Local\Temp\Commander une image.exe
"C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Commander une image.exe"
3⤵
PID:4380

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsm2CF9.tmp\gkqvn.dll
MD5
fb96f242a6a27c728ec11534877114f0

SHA1
72180a0710a8dfb430c7dd71106e70736f8c7291

SHA256
1c7190343deb537619d4f4682646acfb0c3734b3f322fdce0a1e2a0676c9c292

SHA512
34b69e34e8ab46afc4bef93ec2093b6e09f06b29c32e913096ba0ae30d6cd8076ea4b52b5c58d14df3d35b5ce2ce718c960e6914950fe0e05982028492deb62d

Download Submit
memory/2880-131-0x0000000006020000-0x000000000618E000-memory.dmp

Filesize
1.4MB

Download
memory/2880-124-0x0000000004E10000-0x0000000004F59000-memory.dmp

Filesize
1.3MB

Download
memory/4260-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4260-120-0x000000000041F200-mapping.dmp

Download
memory/4260-123-0x00000000009E0000-0x00000000009F5000-memory.dmp

Filesize
84KB

Download
memory/4260-122-0x0000000000AC0000-0x0000000000DE0000-memory.dmp

Filesize
3.1MB

Download
memory/4268-125-0x0000000000000000-mapping.dmp

Download
memory/4268-128-0x0000000002F90000-0x0000000002FBF000-memory.dmp

Filesize
188KB

Download
memory/4268-127-0x0000000000AB0000-0x0000000000AB7000-memory.dmp

Filesize
28KB

Download
memory/4268-129-0x0000000003580000-0x00000000038A0000-memory.dmp

Filesize
3.1MB

Download
memory/4268-130-0x0000000003460000-0x00000000034F4000-memory.dmp

Filesize
592KB

Download
memory/4380-126-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads