formbook | 983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59

General

Target

jetss4321.exe
Size

213KB
MD5

0f558015aea4fab0704f0a81241c95de
SHA1

701d1f39fd047f93543d63fa93b7cdf6ef29d1ee
SHA256

983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59
SHA512

19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425
SSDEEP

6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

Score

10^/10

formbook je14 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/792-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1444-71-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook
behavioral1/memory/1444-75-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

dddlirbk.exedddlirbk.exe

pid process

1724 dddlirbk.exe
792 dddlirbk.exe
Loads dropped DLL 2 IoCs

Processes:

jetss4321.exedddlirbk.exe

pid process

564 jetss4321.exe
1724 dddlirbk.exe

pid	process
1724	dddlirbk.exe
792	dddlirbk.exe

pid	process
564	jetss4321.exe
1724	dddlirbk.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

dddlirbk.exedddlirbk.exewlanext.exe

description	pid	process	target process
PID 1724 set thread context of 792	1724	dddlirbk.exe	dddlirbk.exe
PID 792 set thread context of 1236	792	dddlirbk.exe	Explorer.EXE
PID 1444 set thread context of 1236	1444	wlanext.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

dddlirbk.exewlanext.exe

pid	process
792	dddlirbk.exe
792	dddlirbk.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe
1444	wlanext.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

dddlirbk.exedddlirbk.exewlanext.exe

pid process

1724 dddlirbk.exe
792 dddlirbk.exe
792 dddlirbk.exe
792 dddlirbk.exe
1444 wlanext.exe
1444 wlanext.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dddlirbk.exewlanext.exe

description pid process

Token: SeDebugPrivilege 792 dddlirbk.exe
Token: SeDebugPrivilege 1444 wlanext.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE

pid	process
1724	dddlirbk.exe
792	dddlirbk.exe
792	dddlirbk.exe
792	dddlirbk.exe
1444	wlanext.exe
1444	wlanext.exe

description	pid	process
Token: SeDebugPrivilege	792	dddlirbk.exe
Token: SeDebugPrivilege	1444	wlanext.exe

pid	process
1236	Explorer.EXE
1236	Explorer.EXE

pid	process
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

jetss4321.exedddlirbk.exeExplorer.EXEwlanext.exe

description	pid	process	target process
PID 564 wrote to memory of 1724	564	jetss4321.exe	dddlirbk.exe
PID 564 wrote to memory of 1724	564	jetss4321.exe	dddlirbk.exe
PID 564 wrote to memory of 1724	564	jetss4321.exe	dddlirbk.exe
PID 564 wrote to memory of 1724	564	jetss4321.exe	dddlirbk.exe
PID 1724 wrote to memory of 792	1724	dddlirbk.exe	dddlirbk.exe
PID 1724 wrote to memory of 792	1724	dddlirbk.exe	dddlirbk.exe
PID 1724 wrote to memory of 792	1724	dddlirbk.exe	dddlirbk.exe
PID 1724 wrote to memory of 792	1724	dddlirbk.exe	dddlirbk.exe
PID 1724 wrote to memory of 792	1724	dddlirbk.exe	dddlirbk.exe
PID 1236 wrote to memory of 1444	1236	Explorer.EXE	wlanext.exe
PID 1236 wrote to memory of 1444	1236	Explorer.EXE	wlanext.exe
PID 1236 wrote to memory of 1444	1236	Explorer.EXE	wlanext.exe
PID 1236 wrote to memory of 1444	1236	Explorer.EXE	wlanext.exe
PID 1444 wrote to memory of 1304	1444	wlanext.exe	cmd.exe
PID 1444 wrote to memory of 1304	1444	wlanext.exe	cmd.exe
PID 1444 wrote to memory of 1304	1444	wlanext.exe	cmd.exe
PID 1444 wrote to memory of 1304	1444	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\jetss4321.exe
"C:\Users\Admin\AppData\Local\Temp\jetss4321.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:564

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bqinymrhxf.yg
Filesize
5KB

MD5
1aaeec34da067db10371ba0d65bd2fdf

SHA1
ab511719298e745360040a627d96ddba9f5aa9c5

SHA256
1f0a4869a22601f432ba6b2630ee4b7b30d2a924cc18df5dda45ff89734c8931

SHA512
22f2a8db2a256d919144a299b49c8f59193255a2ac53eed793cff20996e79ffe26fd0266bce143128d95ca2dc4863e835540068a5e51895025bf664272defca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dzotwnqy.hu
Filesize
185KB

MD5
3bea76e24c8cb495dee7e2a748025d30

SHA1
9f10de59f3dfb639e6fbe4236854fa73d6f78991

SHA256
765bed83e6d866446fcd3fe7398f97e889c21a57f6bb4c2bd552c48e1b074a32

SHA512
0a05cace5349e733526f51e2db95a794695fe71f8bcb645401a955d66dcd3d0b7af486df3572ad2fc9825d173edd243ffeab33e106abcead508c114c03c22592

Download Submit
\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
memory/564-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/792-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/792-62-0x000000000041F120-mapping.dmp

Download
memory/792-65-0x0000000000900000-0x0000000000C03000-memory.dmp

Filesize
3.0MB

Download
memory/792-66-0x00000000002B0000-0x00000000002C4000-memory.dmp

Filesize
80KB

Download
memory/1236-76-0x0000000004C30000-0x0000000004D23000-memory.dmp

Filesize
972KB

Download
memory/1236-67-0x0000000004980000-0x0000000004A44000-memory.dmp

Filesize
784KB

Download
memory/1236-74-0x0000000004C30000-0x0000000004D23000-memory.dmp

Filesize
972KB

Download
memory/1304-69-0x0000000000000000-mapping.dmp

Download
memory/1444-70-0x0000000000D40000-0x0000000000D56000-memory.dmp

Filesize
88KB

Download
memory/1444-71-0x00000000000D0000-0x00000000000FF000-memory.dmp

Filesize
188KB

Download
memory/1444-72-0x0000000002160000-0x0000000002463000-memory.dmp

Filesize
3.0MB

Download
memory/1444-73-0x0000000000900000-0x0000000000993000-memory.dmp

Filesize
588KB

Download
memory/1444-68-0x0000000000000000-mapping.dmp

Download
memory/1444-75-0x00000000000D0000-0x00000000000FF000-memory.dmp

Filesize
188KB

Download
memory/1724-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads