formbook | e194070816893a21e24161a8d2d86179ee9d126cf33274883e0a43e834d6a328

Analysis

max time kernel
150s
max time network
142s
platform
windows10_x64
resource
win10-en-20211014
submitted
18-11-2021 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order Inquiry.exe
Size

291KB
MD5

6ae1bea4f4c5b2c492d1783df7712a8a
SHA1

df3c0ecb8758ec86ff061c084f84239561c16db0
SHA256

e194070816893a21e24161a8d2d86179ee9d126cf33274883e0a43e834d6a328
SHA512

0e8cc0af0aa55cb49f32208aa6e27a491ddbbfbf4566ace36bc128710a7e04acaf9d352ff7ccf7c584beacc29d67526be941b80be13f77a2c26aac289ad0c0c6

Score

10^/10

formbook dn7r rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1320-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1320-117-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/1224-125-0x0000000000C60000-0x0000000000C8F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

Order Inquiry.exe

pid process

4052 Order Inquiry.exe

pid	process
4052	Order Inquiry.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Order Inquiry.exeOrder Inquiry.exehelp.exe

description	pid	process	target process
PID 4052 set thread context of 1320	4052	Order Inquiry.exe	Order Inquiry.exe
PID 1320 set thread context of 3028	1320	Order Inquiry.exe	Explorer.EXE
PID 1224 set thread context of 3028	1224	help.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Order Inquiry.exehelp.exe

pid	process
1320	Order Inquiry.exe
1320	Order Inquiry.exe
1320	Order Inquiry.exe
1320	Order Inquiry.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe
1224	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3028 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Order Inquiry.exehelp.exe

pid process

1320 Order Inquiry.exe
1320 Order Inquiry.exe
1320 Order Inquiry.exe
1224 help.exe
1224 help.exe

pid	process
3028	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

Order Inquiry.exehelp.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1320	Order Inquiry.exe
Token: SeDebugPrivilege	1224	help.exe
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Order Inquiry.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 4052 wrote to memory of 1320	4052	Order Inquiry.exe	Order Inquiry.exe
PID 4052 wrote to memory of 1320	4052	Order Inquiry.exe	Order Inquiry.exe
PID 4052 wrote to memory of 1320	4052	Order Inquiry.exe	Order Inquiry.exe
PID 4052 wrote to memory of 1320	4052	Order Inquiry.exe	Order Inquiry.exe
PID 4052 wrote to memory of 1320	4052	Order Inquiry.exe	Order Inquiry.exe
PID 4052 wrote to memory of 1320	4052	Order Inquiry.exe	Order Inquiry.exe
PID 3028 wrote to memory of 1224	3028	Explorer.EXE	help.exe
PID 3028 wrote to memory of 1224	3028	Explorer.EXE	help.exe
PID 3028 wrote to memory of 1224	3028	Explorer.EXE	help.exe
PID 1224 wrote to memory of 1576	1224	help.exe	cmd.exe
PID 1224 wrote to memory of 1576	1224	help.exe	cmd.exe
PID 1224 wrote to memory of 1576	1224	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"
3⤵
PID:1576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdD8CE.tmp\sqyihw.dll
MD5
541f18fb8b236e3db5b3e87c4cbf3694

SHA1
2c7bcfa2c3dee0528d53a57ba00e410203c7d23c

SHA256
6032964aa339af53c7217b719143a72cf3b5dd55315476ecb4e26a41bdd4736f

SHA512
55d91543dafedfbe108bbe294a8a7a155c1643340219bd53b4da275d33422fc1243704e29751324fbb13a9ed8af8c13e246131335dcd57e1f8e578a70346fb35

Download Submit
memory/1224-122-0x0000000000000000-mapping.dmp

Download
memory/1224-125-0x0000000000C60000-0x0000000000C8F000-memory.dmp

Filesize
188KB

Download
memory/1224-124-0x0000000000EF0000-0x0000000000EF7000-memory.dmp

Filesize
28KB

Download
memory/1224-126-0x00000000033F0000-0x0000000003710000-memory.dmp

Filesize
3.1MB

Download
memory/1224-127-0x00000000031B0000-0x0000000003244000-memory.dmp

Filesize
592KB

Download
memory/1320-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1320-117-0x000000000041F200-mapping.dmp

Download
memory/1320-120-0x00000000005E0000-0x00000000005F5000-memory.dmp

Filesize
84KB

Download
memory/1320-119-0x0000000000A90000-0x0000000000DB0000-memory.dmp

Filesize
3.1MB

Download
memory/1576-123-0x0000000000000000-mapping.dmp

Download
memory/3028-167-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-145-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-130-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-129-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-131-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/3028-134-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-133-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-132-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-135-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-136-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-137-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-138-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-139-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-140-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-141-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-142-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-143-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-144-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-174-0x0000000002190000-0x00000000021A0000-memory.dmp

Filesize
64KB

Download
memory/3028-146-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-147-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-148-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-149-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-150-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-151-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-152-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-153-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-154-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-155-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-156-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-157-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-159-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-158-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/3028-160-0x0000000000840000-0x0000000000850000-memory.dmp

Filesize
64KB

Download
memory/3028-161-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-162-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-164-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-163-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-166-0x0000000002190000-0x00000000021A0000-memory.dmp

Filesize
64KB

Download
memory/3028-165-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-168-0x0000000002190000-0x00000000021A0000-memory.dmp

Filesize
64KB

Download
memory/3028-121-0x0000000005D30000-0x0000000005E61000-memory.dmp

Filesize
1.2MB

Download
memory/3028-170-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-169-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-172-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-171-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-187-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-128-0x0000000002700000-0x00000000027C5000-memory.dmp

Filesize
788KB

Download
memory/3028-184-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-175-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-177-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-178-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-179-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/3028-180-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-181-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-182-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-183-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-176-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-185-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-186-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-173-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-188-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-189-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-190-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-191-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-192-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-193-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-194-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-195-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-196-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-197-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/3028-198-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-199-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-200-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-201-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-203-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-202-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/3028-205-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-204-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-207-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-206-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-209-0x00000000007C0000-0x00000000007D0000-memory.dmp

Filesize
64KB

Download
memory/3028-208-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-211-0x00000000007C0000-0x00000000007D0000-memory.dmp

Filesize
64KB

Download
memory/3028-213-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-212-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-210-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-214-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-216-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-218-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-220-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-219-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-221-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/3028-217-0x00000000007C0000-0x00000000007D0000-memory.dmp

Filesize
64KB

Download
memory/3028-215-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download