formbook | c99e87423f7904055d6d9b0952ae05f17dae342dd13618892a272e8805f0609b

General

Target

e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
Size

298KB
MD5

1a5ca5189741f2c19b37636cc75b4287
SHA1

e424558e20ed8cf4da62dea3b4633af6acd5c76a
SHA256

c99e87423f7904055d6d9b0952ae05f17dae342dd13618892a272e8805f0609b
SHA512

712b9567e95c795e83be25a9beafea096901e4ffc2830d165a747eca3d54a11360401e3dac4c29c0248d47640fa2898093b27c3dc9e0a8ee2cb92ca1424eca82

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/572-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/572-58-0x000000000041F200-mapping.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

pid process

1952 e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

pid	process
1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

description	pid	process	target process
PID 1952 set thread context of 572	1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

pid process

572 e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

pid	process
572	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

description	pid	process	target process
PID 1952 wrote to memory of 572	1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
PID 1952 wrote to memory of 572	1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
PID 1952 wrote to memory of 572	1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
PID 1952 wrote to memory of 572	1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
PID 1952 wrote to memory of 572	1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
PID 1952 wrote to memory of 572	1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
PID 1952 wrote to memory of 572	1952	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe	e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe

C:\Users\Admin\AppData\Local\Temp\e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
"C:\Users\Admin\AppData\Local\Temp\e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe
"C:\Users\Admin\AppData\Local\Temp\e424558e20ed8cf4da62dea3b4633af6acd5c76a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:572

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsyDAA7.tmp\grxsjrpfht.dll
MD5
61c4b7394d84264ec010c0478a289703

SHA1
4b29cad5a19a309149d90cc202502805aac9a6b7

SHA256
38def99887e4a4994d02f80e7e00081edfdc0ff9c628139e83882f5280fdc393

SHA512
8888ed48832e3c550f99b364fc8087677fce9c8a2cfa2f3528b8d6aac546f297edbeea8d181cb0b0ccd649715cd91026fd8d98fab2a1b59368e47da2101d9eeb

Download Submit
memory/572-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/572-58-0x000000000041F200-mapping.dmp

Download
memory/572-59-0x00000000008C0000-0x0000000000BC3000-memory.dmp

Filesize
3.0MB

Download
memory/1952-55-0x0000000075F41000-0x0000000075F43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads