formbook | 10a4841b7d56afca3aad568e29fcd3c44f3a0d893aef62ee32471847be405797

General

Target

customs docs.exe
Size

332KB
MD5

4e42888ffbe2082ce98d4375eb9c3794
SHA1

d8c46cc203e6d92bf607d2637d37937dc08466f3
SHA256

10a4841b7d56afca3aad568e29fcd3c44f3a0d893aef62ee32471847be405797
SHA512

b1c3861f56fe907dcbef25beeda63ebdc2000381c80fcec44018d7b41963174c06ad9f765571ecb8c3796437ddd17317bbc3a1e152ef44e5575538bc84bf23f1

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3332-119-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3332-120-0x000000000041F200-mapping.dmp	formbook
behavioral2/memory/4092-128-0x0000000000370000-0x000000000039F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

customs docs.exe

pid process

3632 customs docs.exe

pid	process
3632	customs docs.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

customs docs.execustoms docs.exenetsh.exe

description	pid	process	target process
PID 3632 set thread context of 3332	3632	customs docs.exe	customs docs.exe
PID 3332 set thread context of 3020	3332	customs docs.exe	Explorer.EXE
PID 4092 set thread context of 3020	4092	netsh.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

customs docs.exenetsh.exe

pid	process
3332	customs docs.exe
3332	customs docs.exe
3332	customs docs.exe
3332	customs docs.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe
4092	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3020 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

customs docs.exenetsh.exe

pid process

3332 customs docs.exe
3332 customs docs.exe
3332 customs docs.exe
4092 netsh.exe
4092 netsh.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

customs docs.exenetsh.exe

description pid process

Token: SeDebugPrivilege 3332 customs docs.exe
Token: SeDebugPrivilege 4092 netsh.exe

pid	process
3020	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3332	customs docs.exe
Token: SeDebugPrivilege	4092	netsh.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

customs docs.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 3632 wrote to memory of 3332	3632	customs docs.exe	customs docs.exe
PID 3632 wrote to memory of 3332	3632	customs docs.exe	customs docs.exe
PID 3632 wrote to memory of 3332	3632	customs docs.exe	customs docs.exe
PID 3632 wrote to memory of 3332	3632	customs docs.exe	customs docs.exe
PID 3632 wrote to memory of 3332	3632	customs docs.exe	customs docs.exe
PID 3632 wrote to memory of 3332	3632	customs docs.exe	customs docs.exe
PID 3020 wrote to memory of 4092	3020	Explorer.EXE	netsh.exe
PID 3020 wrote to memory of 4092	3020	Explorer.EXE	netsh.exe
PID 3020 wrote to memory of 4092	3020	Explorer.EXE	netsh.exe
PID 4092 wrote to memory of 652	4092	netsh.exe	cmd.exe
PID 4092 wrote to memory of 652	4092	netsh.exe	cmd.exe
PID 4092 wrote to memory of 652	4092	netsh.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\customs docs.exe
"C:\Users\Admin\AppData\Local\Temp\customs docs.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3632

C:\Users\Admin\AppData\Local\Temp\customs docs.exe
"C:\Users\Admin\AppData\Local\Temp\customs docs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\customs docs.exe"
3⤵
PID:652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsl9F30.tmp\tozsi.dll
MD5
d1779adf728606a60d307556945ce255

SHA1
606a3ae2eb4559bf5bbbeebd092c277c4051df24

SHA256
ee988e74063da10473ad24262a64e2b31729e8afb4f1ffc2424667592cc5adb3

SHA512
d47fc774a63cccd93e9433edb35c56052f7a7a650a220ddebd72eb205f1960bfe58878785839742af15d711e6b8c206c44e500e5e9bb8d8d4b947ec72d1c7121

Download Submit
memory/652-126-0x0000000000000000-mapping.dmp

Download
memory/3020-131-0x0000000006940000-0x0000000006AB3000-memory.dmp

Filesize
1.4MB

Download
memory/3020-124-0x0000000001430000-0x0000000001501000-memory.dmp

Filesize
836KB

Download
memory/3332-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3332-120-0x000000000041F200-mapping.dmp

Download
memory/3332-122-0x00000000009C0000-0x0000000000CE0000-memory.dmp

Filesize
3.1MB

Download
memory/3332-123-0x0000000000D20000-0x0000000000D35000-memory.dmp

Filesize
84KB

Download
memory/4092-125-0x0000000000000000-mapping.dmp

Download
memory/4092-129-0x0000000000F60000-0x0000000001280000-memory.dmp

Filesize
3.1MB

Download
memory/4092-127-0x0000000001360000-0x000000000137E000-memory.dmp

Filesize
120KB

Download
memory/4092-128-0x0000000000370000-0x000000000039F000-memory.dmp

Filesize
188KB

Download
memory/4092-130-0x0000000000DC0000-0x0000000000E54000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads