formbook | bdb2c9e0c8069e6e61fe1971e88a238f01f118e6cf920010d64b806dea954483

General

Target

jetss4321.exe
Size

213KB
MD5

0f558015aea4fab0704f0a81241c95de
SHA1

701d1f39fd047f93543d63fa93b7cdf6ef29d1ee
SHA256

983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59
SHA512

19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425
SSDEEP

6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

Score

10^/10

formbook je14 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2020-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4276-145-0x0000000000750000-0x000000000077F000-memory.dmp	formbook
behavioral2/memory/4276-150-0x0000000000750000-0x000000000077F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

dddlirbk.exedddlirbk.exe

pid process

1460 dddlirbk.exe
2020 dddlirbk.exe

pid	process
1460	dddlirbk.exe
2020	dddlirbk.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

dddlirbk.exedddlirbk.exehelp.exe

description	pid	process	target process
PID 1460 set thread context of 2020	1460	dddlirbk.exe	dddlirbk.exe
PID 2020 set thread context of 1036	2020	dddlirbk.exe	Explorer.EXE
PID 4276 set thread context of 1036	4276	help.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

dddlirbk.exehelp.exe

pid	process
2020	dddlirbk.exe
2020	dddlirbk.exe
2020	dddlirbk.exe
2020	dddlirbk.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe
4276	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1036 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

dddlirbk.exedddlirbk.exehelp.exe

pid process

1460 dddlirbk.exe
2020 dddlirbk.exe
2020 dddlirbk.exe
2020 dddlirbk.exe
4276 help.exe
4276 help.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dddlirbk.exehelp.exe

description pid process

Token: SeDebugPrivilege 2020 dddlirbk.exe
Token: SeDebugPrivilege 4276 help.exe

pid	process
1036	Explorer.EXE

pid	process
1460	dddlirbk.exe
2020	dddlirbk.exe
2020	dddlirbk.exe
2020	dddlirbk.exe
4276	help.exe
4276	help.exe

description	pid	process
Token: SeDebugPrivilege	2020	dddlirbk.exe
Token: SeDebugPrivilege	4276	help.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

jetss4321.exedddlirbk.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 3380 wrote to memory of 1460	3380	jetss4321.exe	dddlirbk.exe
PID 3380 wrote to memory of 1460	3380	jetss4321.exe	dddlirbk.exe
PID 3380 wrote to memory of 1460	3380	jetss4321.exe	dddlirbk.exe
PID 1460 wrote to memory of 2020	1460	dddlirbk.exe	dddlirbk.exe
PID 1460 wrote to memory of 2020	1460	dddlirbk.exe	dddlirbk.exe
PID 1460 wrote to memory of 2020	1460	dddlirbk.exe	dddlirbk.exe
PID 1460 wrote to memory of 2020	1460	dddlirbk.exe	dddlirbk.exe
PID 1036 wrote to memory of 4276	1036	Explorer.EXE	help.exe
PID 1036 wrote to memory of 4276	1036	Explorer.EXE	help.exe
PID 1036 wrote to memory of 4276	1036	Explorer.EXE	help.exe
PID 4276 wrote to memory of 4264	4276	help.exe	cmd.exe
PID 4276 wrote to memory of 4264	4276	help.exe	cmd.exe
PID 4276 wrote to memory of 4264	4276	help.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\jetss4321.exe
"C:\Users\Admin\AppData\Local\Temp\jetss4321.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3380

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1460

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:4588

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
PID:4264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bqinymrhxf.yg
Filesize
5KB

MD5
1aaeec34da067db10371ba0d65bd2fdf

SHA1
ab511719298e745360040a627d96ddba9f5aa9c5

SHA256
1f0a4869a22601f432ba6b2630ee4b7b30d2a924cc18df5dda45ff89734c8931

SHA512
22f2a8db2a256d919144a299b49c8f59193255a2ac53eed793cff20996e79ffe26fd0266bce143128d95ca2dc4863e835540068a5e51895025bf664272defca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dzotwnqy.hu
Filesize
185KB

MD5
3bea76e24c8cb495dee7e2a748025d30

SHA1
9f10de59f3dfb639e6fbe4236854fa73d6f78991

SHA256
765bed83e6d866446fcd3fe7398f97e889c21a57f6bb4c2bd552c48e1b074a32

SHA512
0a05cace5349e733526f51e2db95a794695fe71f8bcb645401a955d66dcd3d0b7af486df3572ad2fc9825d173edd243ffeab33e106abcead508c114c03c22592

Download Submit
memory/1036-142-0x00000000032D0000-0x00000000033E4000-memory.dmp

Filesize
1.1MB

Download
memory/1036-151-0x0000000008480000-0x0000000008588000-memory.dmp

Filesize
1.0MB

Download
memory/1036-149-0x0000000008480000-0x0000000008588000-memory.dmp

Filesize
1.0MB

Download
memory/1460-132-0x0000000000000000-mapping.dmp

Download
memory/2020-137-0x0000000000000000-mapping.dmp

Download
memory/2020-141-0x0000000000B50000-0x0000000000B64000-memory.dmp

Filesize
80KB

Download
memory/2020-140-0x0000000000E70000-0x00000000011BA000-memory.dmp

Filesize
3.3MB

Download
memory/2020-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4264-146-0x0000000000000000-mapping.dmp

Download
memory/4276-143-0x0000000000000000-mapping.dmp

Download
memory/4276-144-0x00000000006D0000-0x00000000006D7000-memory.dmp

Filesize
28KB

Download
memory/4276-145-0x0000000000750000-0x000000000077F000-memory.dmp

Filesize
188KB

Download
memory/4276-147-0x0000000001150000-0x000000000149A000-memory.dmp

Filesize
3.3MB

Download
memory/4276-148-0x0000000000E90000-0x0000000000F23000-memory.dmp

Filesize
588KB

Download
memory/4276-150-0x0000000000750000-0x000000000077F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads