formbook | e194070816893a21e24161a8d2d86179ee9d126cf33274883e0a43e834d6a328

General

Target

Order Inquiry.exe
Size

291KB
MD5

6ae1bea4f4c5b2c492d1783df7712a8a
SHA1

df3c0ecb8758ec86ff061c084f84239561c16db0
SHA256

e194070816893a21e24161a8d2d86179ee9d126cf33274883e0a43e834d6a328
SHA512

0e8cc0af0aa55cb49f32208aa6e27a491ddbbfbf4566ace36bc128710a7e04acaf9d352ff7ccf7c584beacc29d67526be941b80be13f77a2c26aac289ad0c0c6

Score

10^/10

formbook dn7r rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1124-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1124-58-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/1892-65-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1808 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Order Inquiry.exe

pid process

1236 Order Inquiry.exe

pid	process
1808	cmd.exe

pid	process
1236	Order Inquiry.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Order Inquiry.exeOrder Inquiry.execmmon32.exe

description	pid	process	target process
PID 1236 set thread context of 1124	1236	Order Inquiry.exe	Order Inquiry.exe
PID 1124 set thread context of 1272	1124	Order Inquiry.exe	Explorer.EXE
PID 1892 set thread context of 1272	1892	cmmon32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Order Inquiry.execmmon32.exe

pid	process
1124	Order Inquiry.exe
1124	Order Inquiry.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe
1892	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Order Inquiry.execmmon32.exe

pid process

1124 Order Inquiry.exe
1124 Order Inquiry.exe
1124 Order Inquiry.exe
1892 cmmon32.exe
1892 cmmon32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Order Inquiry.execmmon32.exe

description pid process

Token: SeDebugPrivilege 1124 Order Inquiry.exe
Token: SeDebugPrivilege 1892 cmmon32.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE

pid	process
1272	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1124	Order Inquiry.exe
Token: SeDebugPrivilege	1892	cmmon32.exe

pid	process
1272	Explorer.EXE
1272	Explorer.EXE

pid	process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Order Inquiry.exeExplorer.EXEcmmon32.exe

description	pid	process	target process
PID 1236 wrote to memory of 1124	1236	Order Inquiry.exe	Order Inquiry.exe
PID 1236 wrote to memory of 1124	1236	Order Inquiry.exe	Order Inquiry.exe
PID 1236 wrote to memory of 1124	1236	Order Inquiry.exe	Order Inquiry.exe
PID 1236 wrote to memory of 1124	1236	Order Inquiry.exe	Order Inquiry.exe
PID 1236 wrote to memory of 1124	1236	Order Inquiry.exe	Order Inquiry.exe
PID 1236 wrote to memory of 1124	1236	Order Inquiry.exe	Order Inquiry.exe
PID 1236 wrote to memory of 1124	1236	Order Inquiry.exe	Order Inquiry.exe
PID 1272 wrote to memory of 1892	1272	Explorer.EXE	cmmon32.exe
PID 1272 wrote to memory of 1892	1272	Explorer.EXE	cmmon32.exe
PID 1272 wrote to memory of 1892	1272	Explorer.EXE	cmmon32.exe
PID 1272 wrote to memory of 1892	1272	Explorer.EXE	cmmon32.exe
PID 1892 wrote to memory of 1808	1892	cmmon32.exe	cmd.exe
PID 1892 wrote to memory of 1808	1892	cmmon32.exe	cmd.exe
PID 1892 wrote to memory of 1808	1892	cmmon32.exe	cmd.exe
PID 1892 wrote to memory of 1808	1892	cmmon32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"
3⤵
- Deletes itself
PID:1808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsnB5D8.tmp\sqyihw.dll
MD5
541f18fb8b236e3db5b3e87c4cbf3694

SHA1
2c7bcfa2c3dee0528d53a57ba00e410203c7d23c

SHA256
6032964aa339af53c7217b719143a72cf3b5dd55315476ecb4e26a41bdd4736f

SHA512
55d91543dafedfbe108bbe294a8a7a155c1643340219bd53b4da275d33422fc1243704e29751324fbb13a9ed8af8c13e246131335dcd57e1f8e578a70346fb35

Download Submit
memory/1124-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1124-58-0x000000000041F200-mapping.dmp

Download
memory/1124-60-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/1124-61-0x0000000000350000-0x0000000000365000-memory.dmp

Filesize
84KB

Download
memory/1236-55-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download
memory/1272-62-0x00000000072C0000-0x0000000007443000-memory.dmp

Filesize
1.5MB

Download
memory/1272-69-0x0000000007100000-0x0000000007239000-memory.dmp

Filesize
1.2MB

Download
memory/1808-66-0x0000000000000000-mapping.dmp

Download
memory/1892-63-0x0000000000000000-mapping.dmp

Download
memory/1892-64-0x0000000000BA0000-0x0000000000BAD000-memory.dmp

Filesize
52KB

Download
memory/1892-65-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1892-67-0x0000000001FB0000-0x00000000022B3000-memory.dmp

Filesize
3.0MB

Download
memory/1892-68-0x0000000000350000-0x00000000003E4000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads