formbook | bdb2c9e0c8069e6e61fe1971e88a238f01f118e6cf920010d64b806dea954483

General

Target

jetss4321.exe
Size

213KB
MD5

0f558015aea4fab0704f0a81241c95de
SHA1

701d1f39fd047f93543d63fa93b7cdf6ef29d1ee
SHA256

983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59
SHA512

19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425
SSDEEP

6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

Score

10^/10

formbook je14 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/948-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/936-70-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook
behavioral1/memory/936-75-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

Processes:

cmd.exe

flow pid process

11 936 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

dddlirbk.exedddlirbk.exe

pid process

1536 dddlirbk.exe
948 dddlirbk.exe
Loads dropped DLL 2 IoCs

Processes:

jetss4321.exedddlirbk.exe

pid process

1672 jetss4321.exe
1536 dddlirbk.exe

flow	pid	process
11	936	cmd.exe

pid	process
1536	dddlirbk.exe
948	dddlirbk.exe

pid	process
1672	jetss4321.exe
1536	dddlirbk.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

dddlirbk.exedddlirbk.execmd.exe

description	pid	process	target process
PID 1536 set thread context of 948	1536	dddlirbk.exe	dddlirbk.exe
PID 948 set thread context of 1280	948	dddlirbk.exe	Explorer.EXE
PID 936 set thread context of 1280	936	cmd.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

dddlirbk.execmd.exe

pid	process
948	dddlirbk.exe
948	dddlirbk.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe
936	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

dddlirbk.exedddlirbk.execmd.exe

pid process

1536 dddlirbk.exe
948 dddlirbk.exe
948 dddlirbk.exe
948 dddlirbk.exe
936 cmd.exe
936 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dddlirbk.execmd.exe

description pid process

Token: SeDebugPrivilege 948 dddlirbk.exe
Token: SeDebugPrivilege 936 cmd.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
1280 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
1280 Explorer.EXE

pid	process
1280	Explorer.EXE

pid	process
1536	dddlirbk.exe
948	dddlirbk.exe
948	dddlirbk.exe
948	dddlirbk.exe
936	cmd.exe
936	cmd.exe

description	pid	process
Token: SeDebugPrivilege	948	dddlirbk.exe
Token: SeDebugPrivilege	936	cmd.exe

pid	process
1280	Explorer.EXE
1280	Explorer.EXE

pid	process
1280	Explorer.EXE
1280	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

jetss4321.exedddlirbk.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 1672 wrote to memory of 1536	1672	jetss4321.exe	dddlirbk.exe
PID 1672 wrote to memory of 1536	1672	jetss4321.exe	dddlirbk.exe
PID 1672 wrote to memory of 1536	1672	jetss4321.exe	dddlirbk.exe
PID 1672 wrote to memory of 1536	1672	jetss4321.exe	dddlirbk.exe
PID 1536 wrote to memory of 948	1536	dddlirbk.exe	dddlirbk.exe
PID 1536 wrote to memory of 948	1536	dddlirbk.exe	dddlirbk.exe
PID 1536 wrote to memory of 948	1536	dddlirbk.exe	dddlirbk.exe
PID 1536 wrote to memory of 948	1536	dddlirbk.exe	dddlirbk.exe
PID 1536 wrote to memory of 948	1536	dddlirbk.exe	dddlirbk.exe
PID 1280 wrote to memory of 936	1280	Explorer.EXE	cmd.exe
PID 1280 wrote to memory of 936	1280	Explorer.EXE	cmd.exe
PID 1280 wrote to memory of 936	1280	Explorer.EXE	cmd.exe
PID 1280 wrote to memory of 936	1280	Explorer.EXE	cmd.exe
PID 936 wrote to memory of 580	936	cmd.exe	cmd.exe
PID 936 wrote to memory of 580	936	cmd.exe	cmd.exe
PID 936 wrote to memory of 580	936	cmd.exe	cmd.exe
PID 936 wrote to memory of 580	936	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\jetss4321.exe
"C:\Users\Admin\AppData\Local\Temp\jetss4321.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
PID:580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bqinymrhxf.yg
Filesize
5KB

MD5
1aaeec34da067db10371ba0d65bd2fdf

SHA1
ab511719298e745360040a627d96ddba9f5aa9c5

SHA256
1f0a4869a22601f432ba6b2630ee4b7b30d2a924cc18df5dda45ff89734c8931

SHA512
22f2a8db2a256d919144a299b49c8f59193255a2ac53eed793cff20996e79ffe26fd0266bce143128d95ca2dc4863e835540068a5e51895025bf664272defca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dzotwnqy.hu
Filesize
185KB

MD5
3bea76e24c8cb495dee7e2a748025d30

SHA1
9f10de59f3dfb639e6fbe4236854fa73d6f78991

SHA256
765bed83e6d866446fcd3fe7398f97e889c21a57f6bb4c2bd552c48e1b074a32

SHA512
0a05cace5349e733526f51e2db95a794695fe71f8bcb645401a955d66dcd3d0b7af486df3572ad2fc9825d173edd243ffeab33e106abcead508c114c03c22592

Download Submit
\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
memory/580-71-0x0000000000000000-mapping.dmp

Download
memory/936-72-0x0000000001F20000-0x0000000002223000-memory.dmp

Filesize
3.0MB

Download
memory/936-73-0x00000000003B0000-0x0000000000443000-memory.dmp

Filesize
588KB

Download
memory/936-68-0x0000000000000000-mapping.dmp

Download
memory/936-69-0x000000004A080000-0x000000004A0CC000-memory.dmp

Filesize
304KB

Download
memory/936-70-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/936-75-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/948-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/948-65-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download
memory/948-66-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download
memory/948-62-0x000000000041F120-mapping.dmp

Download
memory/1280-67-0x0000000004150000-0x000000000425C000-memory.dmp

Filesize
1.0MB

Download
memory/1280-74-0x0000000002C50000-0x0000000002D37000-memory.dmp

Filesize
924KB

Download
memory/1280-76-0x0000000002C50000-0x0000000002D37000-memory.dmp

Filesize
924KB

Download
memory/1280-77-0x000007FEF6690000-0x000007FEF67D3000-memory.dmp

Filesize
1.3MB

Download
memory/1280-78-0x000007FE8DA40000-0x000007FE8DA4A000-memory.dmp

Filesize
40KB

Download
memory/1536-56-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads