formbook | 348778a97c45cddc54eeee10b62106156d4fbb35ec863d96827f94eda6c39a98

General

Target

Order_pdf.exe
Size

422KB
MD5

c6f10bbfaa01950046227177e69f2664
SHA1

43b71fad504b19f3cfeb77b76472a164a9d16166
SHA256

43ea8be5d24e6ef46dc34bbbb6be7841c733449cc2e99144c38d38f85a6527fb
SHA512

4afca32e72d11ea57ca1527d3472de3c9ab6c074a94db562a163b21ab2ee670bfa7a83866cdb207a99351705d81f22fe98112183c9cfea1e3174a3aaca06c4d2

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1488-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1488-58-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/1656-66-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1324 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Order_pdf.exe

pid process

684 Order_pdf.exe

pid	process
1324	cmd.exe

pid	process
684	Order_pdf.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Order_pdf.exeOrder_pdf.exemsdt.exe

description	pid	process	target process
PID 684 set thread context of 1488	684	Order_pdf.exe	Order_pdf.exe
PID 1488 set thread context of 1248	1488	Order_pdf.exe	Explorer.EXE
PID 1656 set thread context of 1248	1656	msdt.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Order_pdf.exemsdt.exe

pid	process
1488	Order_pdf.exe
1488	Order_pdf.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe
1656	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Order_pdf.exemsdt.exe

pid process

1488 Order_pdf.exe
1488 Order_pdf.exe
1488 Order_pdf.exe
1656 msdt.exe
1656 msdt.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Order_pdf.exemsdt.exe

description pid process

Token: SeDebugPrivilege 1488 Order_pdf.exe
Token: SeDebugPrivilege 1656 msdt.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
1248 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
1248 Explorer.EXE

pid	process
1248	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1488	Order_pdf.exe
Token: SeDebugPrivilege	1656	msdt.exe

pid	process
1248	Explorer.EXE
1248	Explorer.EXE

pid	process
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Order_pdf.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 684 wrote to memory of 1488	684	Order_pdf.exe	Order_pdf.exe
PID 684 wrote to memory of 1488	684	Order_pdf.exe	Order_pdf.exe
PID 684 wrote to memory of 1488	684	Order_pdf.exe	Order_pdf.exe
PID 684 wrote to memory of 1488	684	Order_pdf.exe	Order_pdf.exe
PID 684 wrote to memory of 1488	684	Order_pdf.exe	Order_pdf.exe
PID 684 wrote to memory of 1488	684	Order_pdf.exe	Order_pdf.exe
PID 684 wrote to memory of 1488	684	Order_pdf.exe	Order_pdf.exe
PID 1248 wrote to memory of 1656	1248	Explorer.EXE	msdt.exe
PID 1248 wrote to memory of 1656	1248	Explorer.EXE	msdt.exe
PID 1248 wrote to memory of 1656	1248	Explorer.EXE	msdt.exe
PID 1248 wrote to memory of 1656	1248	Explorer.EXE	msdt.exe
PID 1656 wrote to memory of 1324	1656	msdt.exe	cmd.exe
PID 1656 wrote to memory of 1324	1656	msdt.exe	cmd.exe
PID 1656 wrote to memory of 1324	1656	msdt.exe	cmd.exe
PID 1656 wrote to memory of 1324	1656	msdt.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:684

C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe"
3⤵
- Deletes itself
PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsnE8BA.tmp\uhxvuhi.dll
MD5
9287fce2e1d3adcd7ee8c87322e49ea9

SHA1
d0e086c4302fec05a8b34ea949bd2f2f99113de6

SHA256
ded45bb062166012d6d5d07fe8efa36f5aa0306bb91acad8901c89a8d8f867d0

SHA512
e9e6107deeee828a589be368655b865d1539f59cdea3b8f6e8b6d11d16f2f28c1d88d57fc0e78d5e39fc27255db81aa65efd9f57325aa55f970ff0d3245d83a3

Download Submit
memory/684-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1248-62-0x0000000006670000-0x0000000006757000-memory.dmp

Filesize
924KB

Download
memory/1248-70-0x0000000006BD0000-0x0000000006D4C000-memory.dmp

Filesize
1.5MB

Download
memory/1324-68-0x0000000000000000-mapping.dmp

Download
memory/1488-58-0x000000000041F200-mapping.dmp

Download
memory/1488-60-0x00000000008C0000-0x0000000000BC3000-memory.dmp

Filesize
3.0MB

Download
memory/1488-61-0x0000000000350000-0x0000000000365000-memory.dmp

Filesize
84KB

Download
memory/1488-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-63-0x0000000000000000-mapping.dmp

Download
memory/1656-66-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1656-67-0x0000000002210000-0x0000000002513000-memory.dmp

Filesize
3.0MB

Download
memory/1656-65-0x0000000000D10000-0x0000000000E04000-memory.dmp

Filesize
976KB

Download
memory/1656-69-0x0000000000B20000-0x0000000000BB4000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads