formbook | bdb2c9e0c8069e6e61fe1971e88a238f01f118e6cf920010d64b806dea954483

General

Target

jetss4321.exe
Size

213KB
MD5

0f558015aea4fab0704f0a81241c95de
SHA1

701d1f39fd047f93543d63fa93b7cdf6ef29d1ee
SHA256

983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59
SHA512

19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425
SSDEEP

6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

Score

10^/10

formbook je14 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/872-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/872-71-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1496-74-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1496-78-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

dddlirbk.exedddlirbk.exe

pid process

1168 dddlirbk.exe
872 dddlirbk.exe
Loads dropped DLL 2 IoCs

Processes:

jetss4321.exedddlirbk.exe

pid process

948 jetss4321.exe
1168 dddlirbk.exe

pid	process
1168	dddlirbk.exe
872	dddlirbk.exe

pid	process
948	jetss4321.exe
1168	dddlirbk.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

dddlirbk.exedddlirbk.exechkdsk.exe

description	pid	process	target process
PID 1168 set thread context of 872	1168	dddlirbk.exe	dddlirbk.exe
PID 872 set thread context of 1204	872	dddlirbk.exe	Explorer.EXE
PID 872 set thread context of 1204	872	dddlirbk.exe	Explorer.EXE
PID 1496 set thread context of 1204	1496	chkdsk.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

dddlirbk.exechkdsk.exe

pid	process
872	dddlirbk.exe
872	dddlirbk.exe
872	dddlirbk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe
1496	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

dddlirbk.exedddlirbk.exechkdsk.exe

pid process

1168 dddlirbk.exe
872 dddlirbk.exe
872 dddlirbk.exe
872 dddlirbk.exe
872 dddlirbk.exe
1496 chkdsk.exe
1496 chkdsk.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

dddlirbk.exechkdsk.exeExplorer.EXE

description pid process

Token: SeDebugPrivilege 872 dddlirbk.exe
Token: SeDebugPrivilege 1496 chkdsk.exe
Token: SeShutdownPrivilege 1204 Explorer.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE

pid	process
1204	Explorer.EXE

pid	process
1168	dddlirbk.exe
872	dddlirbk.exe
872	dddlirbk.exe
872	dddlirbk.exe
872	dddlirbk.exe
1496	chkdsk.exe
1496	chkdsk.exe

description	pid	process
Token: SeDebugPrivilege	872	dddlirbk.exe
Token: SeDebugPrivilege	1496	chkdsk.exe
Token: SeShutdownPrivilege	1204	Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

jetss4321.exedddlirbk.exedddlirbk.exechkdsk.exe

description	pid	process	target process
PID 948 wrote to memory of 1168	948	jetss4321.exe	dddlirbk.exe
PID 948 wrote to memory of 1168	948	jetss4321.exe	dddlirbk.exe
PID 948 wrote to memory of 1168	948	jetss4321.exe	dddlirbk.exe
PID 948 wrote to memory of 1168	948	jetss4321.exe	dddlirbk.exe
PID 1168 wrote to memory of 872	1168	dddlirbk.exe	dddlirbk.exe
PID 1168 wrote to memory of 872	1168	dddlirbk.exe	dddlirbk.exe
PID 1168 wrote to memory of 872	1168	dddlirbk.exe	dddlirbk.exe
PID 1168 wrote to memory of 872	1168	dddlirbk.exe	dddlirbk.exe
PID 1168 wrote to memory of 872	1168	dddlirbk.exe	dddlirbk.exe
PID 872 wrote to memory of 1496	872	dddlirbk.exe	chkdsk.exe
PID 872 wrote to memory of 1496	872	dddlirbk.exe	chkdsk.exe
PID 872 wrote to memory of 1496	872	dddlirbk.exe	chkdsk.exe
PID 872 wrote to memory of 1496	872	dddlirbk.exe	chkdsk.exe
PID 1496 wrote to memory of 1928	1496	chkdsk.exe	cmd.exe
PID 1496 wrote to memory of 1928	1496	chkdsk.exe	cmd.exe
PID 1496 wrote to memory of 1928	1496	chkdsk.exe	cmd.exe
PID 1496 wrote to memory of 1928	1496	chkdsk.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\jetss4321.exe
"C:\Users\Admin\AppData\Local\Temp\jetss4321.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1168

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
4⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
5⤵
PID:1928

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bqinymrhxf.yg
Filesize
5KB

MD5
1aaeec34da067db10371ba0d65bd2fdf

SHA1
ab511719298e745360040a627d96ddba9f5aa9c5

SHA256
1f0a4869a22601f432ba6b2630ee4b7b30d2a924cc18df5dda45ff89734c8931

SHA512
22f2a8db2a256d919144a299b49c8f59193255a2ac53eed793cff20996e79ffe26fd0266bce143128d95ca2dc4863e835540068a5e51895025bf664272defca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dzotwnqy.hu
Filesize
185KB

MD5
3bea76e24c8cb495dee7e2a748025d30

SHA1
9f10de59f3dfb639e6fbe4236854fa73d6f78991

SHA256
765bed83e6d866446fcd3fe7398f97e889c21a57f6bb4c2bd552c48e1b074a32

SHA512
0a05cace5349e733526f51e2db95a794695fe71f8bcb645401a955d66dcd3d0b7af486df3572ad2fc9825d173edd243ffeab33e106abcead508c114c03c22592

Download Submit
\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
memory/872-66-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download
memory/872-62-0x000000000041F120-mapping.dmp

Download
memory/872-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/872-65-0x0000000000A00000-0x0000000000D03000-memory.dmp

Filesize
3.0MB

Download
memory/872-68-0x00000000002E0000-0x00000000002F4000-memory.dmp

Filesize
80KB

Download
memory/872-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/948-54-0x0000000075651000-0x0000000075653000-memory.dmp

Filesize
8KB

Download
memory/1168-56-0x0000000000000000-mapping.dmp

Download
memory/1204-77-0x00000000092B0000-0x0000000009437000-memory.dmp

Filesize
1.5MB

Download
memory/1204-67-0x0000000006020000-0x0000000006129000-memory.dmp

Filesize
1.0MB

Download
memory/1204-69-0x0000000007840000-0x00000000079CA000-memory.dmp

Filesize
1.5MB

Download
memory/1204-79-0x00000000092B0000-0x0000000009437000-memory.dmp

Filesize
1.5MB

Download
memory/1496-70-0x0000000000000000-mapping.dmp

Download
memory/1496-74-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1496-75-0x0000000002010000-0x0000000002313000-memory.dmp

Filesize
3.0MB

Download
memory/1496-73-0x0000000000610000-0x0000000000617000-memory.dmp

Filesize
28KB

Download
memory/1496-76-0x0000000001EF0000-0x0000000001F83000-memory.dmp

Filesize
588KB

Download
memory/1496-78-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1928-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads