formbook | 10a4841b7d56afca3aad568e29fcd3c44f3a0d893aef62ee32471847be405797

General

Target

customs docs.exe
Size

332KB
MD5

4e42888ffbe2082ce98d4375eb9c3794
SHA1

d8c46cc203e6d92bf607d2637d37937dc08466f3
SHA256

10a4841b7d56afca3aad568e29fcd3c44f3a0d893aef62ee32471847be405797
SHA512

b1c3861f56fe907dcbef25beeda63ebdc2000381c80fcec44018d7b41963174c06ad9f765571ecb8c3796437ddd17317bbc3a1e152ef44e5575538bc84bf23f1

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/468-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/468-58-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/1472-65-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

Processes:

cmd.exe

flow pid process

15 1472 cmd.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1792 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

customs docs.exe

pid process

2044 customs docs.exe

flow	pid	process
15	1472	cmd.exe

pid	process
1792	cmd.exe

pid	process
2044	customs docs.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

customs docs.execustoms docs.execmd.exe

description	pid	process	target process
PID 2044 set thread context of 468	2044	customs docs.exe	customs docs.exe
PID 468 set thread context of 1200	468	customs docs.exe	Explorer.EXE
PID 1472 set thread context of 1200	1472	cmd.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

customs docs.execmd.exe

pid	process
468	customs docs.exe
468	customs docs.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe
1472	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1200 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

customs docs.execmd.exe

pid process

468 customs docs.exe
468 customs docs.exe
468 customs docs.exe
1472 cmd.exe
1472 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

customs docs.execmd.exe

description pid process

Token: SeDebugPrivilege 468 customs docs.exe
Token: SeDebugPrivilege 1472 cmd.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1200 Explorer.EXE
1200 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1200 Explorer.EXE
1200 Explorer.EXE

pid	process
1200	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	468	customs docs.exe
Token: SeDebugPrivilege	1472	cmd.exe

pid	process
1200	Explorer.EXE
1200	Explorer.EXE

pid	process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

customs docs.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 2044 wrote to memory of 468	2044	customs docs.exe	customs docs.exe
PID 2044 wrote to memory of 468	2044	customs docs.exe	customs docs.exe
PID 2044 wrote to memory of 468	2044	customs docs.exe	customs docs.exe
PID 2044 wrote to memory of 468	2044	customs docs.exe	customs docs.exe
PID 2044 wrote to memory of 468	2044	customs docs.exe	customs docs.exe
PID 2044 wrote to memory of 468	2044	customs docs.exe	customs docs.exe
PID 2044 wrote to memory of 468	2044	customs docs.exe	customs docs.exe
PID 1200 wrote to memory of 1472	1200	Explorer.EXE	cmd.exe
PID 1200 wrote to memory of 1472	1200	Explorer.EXE	cmd.exe
PID 1200 wrote to memory of 1472	1200	Explorer.EXE	cmd.exe
PID 1200 wrote to memory of 1472	1200	Explorer.EXE	cmd.exe
PID 1472 wrote to memory of 1792	1472	cmd.exe	cmd.exe
PID 1472 wrote to memory of 1792	1472	cmd.exe	cmd.exe
PID 1472 wrote to memory of 1792	1472	cmd.exe	cmd.exe
PID 1472 wrote to memory of 1792	1472	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\customs docs.exe
"C:\Users\Admin\AppData\Local\Temp\customs docs.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\customs docs.exe
"C:\Users\Admin\AppData\Local\Temp\customs docs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\customs docs.exe"
3⤵
- Deletes itself
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsyDD17.tmp\tozsi.dll
MD5
d1779adf728606a60d307556945ce255

SHA1
606a3ae2eb4559bf5bbbeebd092c277c4051df24

SHA256
ee988e74063da10473ad24262a64e2b31729e8afb4f1ffc2424667592cc5adb3

SHA512
d47fc774a63cccd93e9433edb35c56052f7a7a650a220ddebd72eb205f1960bfe58878785839742af15d711e6b8c206c44e500e5e9bb8d8d4b947ec72d1c7121

Download Submit
memory/468-60-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download
memory/468-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/468-58-0x000000000041F200-mapping.dmp

Download
memory/468-61-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/1200-62-0x0000000007340000-0x0000000007471000-memory.dmp

Filesize
1.2MB

Download
memory/1200-69-0x0000000004250000-0x000000000435B000-memory.dmp

Filesize
1.0MB

Download
memory/1472-63-0x0000000000000000-mapping.dmp

Download
memory/1472-64-0x000000004A9A0000-0x000000004A9EC000-memory.dmp

Filesize
304KB

Download
memory/1472-65-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1472-67-0x0000000001EE0000-0x00000000021E3000-memory.dmp

Filesize
3.0MB

Download
memory/1472-68-0x00000000021F0000-0x0000000002284000-memory.dmp

Filesize
592KB

Download
memory/1792-66-0x0000000000000000-mapping.dmp

Download
memory/2044-55-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads