formbook | 4fcbb9ac5129df9ecf9aac331df477a647d2a8c7081b73f2d27aef62d1a6cbaa

General

Target

Order form.exe
Size

504KB
MD5

d4d2f0959d0b9197e2bc86880c543a92
SHA1

73823ab2066e8b461ad5b20575b64e6ca0b04640
SHA256

4fcbb9ac5129df9ecf9aac331df477a647d2a8c7081b73f2d27aef62d1a6cbaa
SHA512

fe5e2466b81462ef1df7ac62383f62e55675364d29ecd6f1db93def8bf1b6e21fdcf9adc45c2c134e1443314ad81c54941bfaf7d4167ce431bd2960da38c7ba9

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/548-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/548-58-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/548-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1992-68-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1796 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

Order form.exe

pid process

1268 Order form.exe

pid	process
1796	cmd.exe

pid	process
1268	Order form.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Order form.exeOrder form.exesvchost.exe

description	pid	process	target process
PID 1268 set thread context of 548	1268	Order form.exe	Order form.exe
PID 548 set thread context of 1412	548	Order form.exe	Explorer.EXE
PID 548 set thread context of 1412	548	Order form.exe	Explorer.EXE
PID 1992 set thread context of 1412	1992	svchost.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

Order form.exesvchost.exe

pid	process
548	Order form.exe
548	Order form.exe
548	Order form.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Order form.exesvchost.exe

pid process

548 Order form.exe
548 Order form.exe
548 Order form.exe
548 Order form.exe
1992 svchost.exe
1992 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Order form.exesvchost.exe

description pid process

Token: SeDebugPrivilege 548 Order form.exe
Token: SeDebugPrivilege 1992 svchost.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
1412 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
1412 Explorer.EXE

pid	process
1412	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	548	Order form.exe
Token: SeDebugPrivilege	1992	svchost.exe

pid	process
1412	Explorer.EXE
1412	Explorer.EXE

pid	process
1412	Explorer.EXE
1412	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Order form.exeOrder form.exesvchost.exe

description	pid	process	target process
PID 1268 wrote to memory of 548	1268	Order form.exe	Order form.exe
PID 1268 wrote to memory of 548	1268	Order form.exe	Order form.exe
PID 1268 wrote to memory of 548	1268	Order form.exe	Order form.exe
PID 1268 wrote to memory of 548	1268	Order form.exe	Order form.exe
PID 1268 wrote to memory of 548	1268	Order form.exe	Order form.exe
PID 1268 wrote to memory of 548	1268	Order form.exe	Order form.exe
PID 1268 wrote to memory of 548	1268	Order form.exe	Order form.exe
PID 548 wrote to memory of 1992	548	Order form.exe	svchost.exe
PID 548 wrote to memory of 1992	548	Order form.exe	svchost.exe
PID 548 wrote to memory of 1992	548	Order form.exe	svchost.exe
PID 548 wrote to memory of 1992	548	Order form.exe	svchost.exe
PID 1992 wrote to memory of 1796	1992	svchost.exe	cmd.exe
PID 1992 wrote to memory of 1796	1992	svchost.exe	cmd.exe
PID 1992 wrote to memory of 1796	1992	svchost.exe	cmd.exe
PID 1992 wrote to memory of 1796	1992	svchost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1412

C:\Users\Admin\AppData\Local\Temp\Order form.exe
"C:\Users\Admin\AppData\Local\Temp\Order form.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\Order form.exe
"C:\Users\Admin\AppData\Local\Temp\Order form.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Order form.exe"
5⤵
- Deletes itself
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiD431.tmp\kmuasy.dll
MD5
42a7fa285b5c17f492bb125b8b3d47ba

SHA1
744f37cecdaf575d948b67077d24315461bb0835

SHA256
de9642df7f7270d0a399a1d046a060eba02d63e189cdb037d2d3c36cb5e66781

SHA512
e3d57d2f86b0fe86ba06ebdf01e71cc4702dcfe3f843b58690620a00fa73b28c31787de6e239d4a9d63e74d6ab17afb071397548d9744da5e34f9076e165b133

Download Submit
memory/548-64-0x0000000000390000-0x00000000003A5000-memory.dmp

Filesize
84KB

Download
memory/548-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/548-58-0x000000000041F200-mapping.dmp

Download
memory/548-60-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/548-61-0x0000000000340000-0x0000000000355000-memory.dmp

Filesize
84KB

Download
memory/548-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1268-55-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1412-65-0x00000000073B0000-0x00000000074EE000-memory.dmp

Filesize
1.2MB

Download
memory/1412-62-0x0000000006610000-0x000000000672C000-memory.dmp

Filesize
1.1MB

Download
memory/1412-72-0x00000000062D0000-0x000000000639A000-memory.dmp

Filesize
808KB

Download
memory/1796-70-0x0000000000000000-mapping.dmp

Download
memory/1992-66-0x0000000000000000-mapping.dmp

Download
memory/1992-68-0x0000000000090000-0x00000000000BF000-memory.dmp

Filesize
188KB

Download
memory/1992-67-0x0000000000040000-0x0000000000048000-memory.dmp

Filesize
32KB

Download
memory/1992-69-0x0000000000830000-0x0000000000B33000-memory.dmp

Filesize
3.0MB

Download
memory/1992-71-0x00000000005B0000-0x0000000000644000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads