formbook | 348778a97c45cddc54eeee10b62106156d4fbb35ec863d96827f94eda6c39a98

General

Target

Order_pdf.exe
Size

422KB
MD5

c6f10bbfaa01950046227177e69f2664
SHA1

43b71fad504b19f3cfeb77b76472a164a9d16166
SHA256

43ea8be5d24e6ef46dc34bbbb6be7841c733449cc2e99144c38d38f85a6527fb
SHA512

4afca32e72d11ea57ca1527d3472de3c9ab6c074a94db562a163b21ab2ee670bfa7a83866cdb207a99351705d81f22fe98112183c9cfea1e3174a3aaca06c4d2

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4032-119-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4032-120-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/4068-127-0x0000000000D70000-0x0000000000D9F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

Order_pdf.exe

pid process

3024 Order_pdf.exe

pid	process
3024	Order_pdf.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Order_pdf.exeOrder_pdf.exesvchost.exe

description	pid	process	target process
PID 3024 set thread context of 4032	3024	Order_pdf.exe	Order_pdf.exe
PID 4032 set thread context of 3044	4032	Order_pdf.exe	Explorer.EXE
PID 4068 set thread context of 3044	4068	svchost.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

Order_pdf.exesvchost.exe

pid	process
4032	Order_pdf.exe
4032	Order_pdf.exe
4032	Order_pdf.exe
4032	Order_pdf.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe
4068	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3044 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Order_pdf.exesvchost.exe

pid process

4032 Order_pdf.exe
4032 Order_pdf.exe
4032 Order_pdf.exe
4068 svchost.exe
4068 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Order_pdf.exesvchost.exe

description pid process

Token: SeDebugPrivilege 4032 Order_pdf.exe
Token: SeDebugPrivilege 4068 svchost.exe

pid	process
3044	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	4032	Order_pdf.exe
Token: SeDebugPrivilege	4068	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Order_pdf.exeExplorer.EXEsvchost.exe

description	pid	process	target process
PID 3024 wrote to memory of 4032	3024	Order_pdf.exe	Order_pdf.exe
PID 3024 wrote to memory of 4032	3024	Order_pdf.exe	Order_pdf.exe
PID 3024 wrote to memory of 4032	3024	Order_pdf.exe	Order_pdf.exe
PID 3024 wrote to memory of 4032	3024	Order_pdf.exe	Order_pdf.exe
PID 3024 wrote to memory of 4032	3024	Order_pdf.exe	Order_pdf.exe
PID 3024 wrote to memory of 4032	3024	Order_pdf.exe	Order_pdf.exe
PID 3044 wrote to memory of 4068	3044	Explorer.EXE	svchost.exe
PID 3044 wrote to memory of 4068	3044	Explorer.EXE	svchost.exe
PID 3044 wrote to memory of 4068	3044	Explorer.EXE	svchost.exe
PID 4068 wrote to memory of 4220	4068	svchost.exe	cmd.exe
PID 4068 wrote to memory of 4220	4068	svchost.exe	cmd.exe
PID 4068 wrote to memory of 4220	4068	svchost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3044

C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Order_pdf.exe"
3⤵
PID:4220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nspDC68.tmp\uhxvuhi.dll
MD5
9287fce2e1d3adcd7ee8c87322e49ea9

SHA1
d0e086c4302fec05a8b34ea949bd2f2f99113de6

SHA256
ded45bb062166012d6d5d07fe8efa36f5aa0306bb91acad8901c89a8d8f867d0

SHA512
e9e6107deeee828a589be368655b865d1539f59cdea3b8f6e8b6d11d16f2f28c1d88d57fc0e78d5e39fc27255db81aa65efd9f57325aa55f970ff0d3245d83a3

Download Submit
memory/3044-131-0x0000000002560000-0x00000000025F7000-memory.dmp

Filesize
604KB

Download
memory/3044-124-0x0000000005B60000-0x0000000005CA5000-memory.dmp

Filesize
1.3MB

Download
memory/4032-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4032-120-0x000000000041F200-mapping.dmp

Download
memory/4032-123-0x0000000000E40000-0x0000000000E55000-memory.dmp

Filesize
84KB

Download
memory/4032-122-0x00000000009D0000-0x0000000000CF0000-memory.dmp

Filesize
3.1MB

Download
memory/4068-125-0x0000000000000000-mapping.dmp

Download
memory/4068-127-0x0000000000D70000-0x0000000000D9F000-memory.dmp

Filesize
188KB

Download
memory/4068-128-0x0000000003300000-0x000000000344A000-memory.dmp

Filesize
1.3MB

Download
memory/4068-130-0x0000000003620000-0x00000000036B4000-memory.dmp

Filesize
592KB

Download
memory/4068-126-0x0000000001140000-0x000000000114C000-memory.dmp

Filesize
48KB

Download
memory/4220-129-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads