formbook | bdb2c9e0c8069e6e61fe1971e88a238f01f118e6cf920010d64b806dea954483

General

Target

jetss4321.exe
Size

213KB
MD5

0f558015aea4fab0704f0a81241c95de
SHA1

701d1f39fd047f93543d63fa93b7cdf6ef29d1ee
SHA256

983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59
SHA512

19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425
SSDEEP

6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

Score

10^/10

formbook je14 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4164-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4060-145-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4060-150-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

dddlirbk.exedddlirbk.exe

pid process

2100 dddlirbk.exe
4164 dddlirbk.exe

pid	process
2100	dddlirbk.exe
4164	dddlirbk.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

dddlirbk.exedddlirbk.exeraserver.exe

description	pid	process	target process
PID 2100 set thread context of 4164	2100	dddlirbk.exe	dddlirbk.exe
PID 4164 set thread context of 3064	4164	dddlirbk.exe	Explorer.EXE
PID 4060 set thread context of 3064	4060	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

dddlirbk.exeraserver.exe

pid	process
4164	dddlirbk.exe
4164	dddlirbk.exe
4164	dddlirbk.exe
4164	dddlirbk.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe
4060	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3064 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

dddlirbk.exedddlirbk.exeraserver.exe

pid process

2100 dddlirbk.exe
4164 dddlirbk.exe
4164 dddlirbk.exe
4164 dddlirbk.exe
4060 raserver.exe
4060 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dddlirbk.exeraserver.exe

description pid process

Token: SeDebugPrivilege 4164 dddlirbk.exe
Token: SeDebugPrivilege 4060 raserver.exe

pid	process
3064	Explorer.EXE

pid	process
2100	dddlirbk.exe
4164	dddlirbk.exe
4164	dddlirbk.exe
4164	dddlirbk.exe
4060	raserver.exe
4060	raserver.exe

description	pid	process
Token: SeDebugPrivilege	4164	dddlirbk.exe
Token: SeDebugPrivilege	4060	raserver.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

jetss4321.exedddlirbk.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 4972 wrote to memory of 2100	4972	jetss4321.exe	dddlirbk.exe
PID 4972 wrote to memory of 2100	4972	jetss4321.exe	dddlirbk.exe
PID 4972 wrote to memory of 2100	4972	jetss4321.exe	dddlirbk.exe
PID 2100 wrote to memory of 4164	2100	dddlirbk.exe	dddlirbk.exe
PID 2100 wrote to memory of 4164	2100	dddlirbk.exe	dddlirbk.exe
PID 2100 wrote to memory of 4164	2100	dddlirbk.exe	dddlirbk.exe
PID 2100 wrote to memory of 4164	2100	dddlirbk.exe	dddlirbk.exe
PID 3064 wrote to memory of 4060	3064	Explorer.EXE	raserver.exe
PID 3064 wrote to memory of 4060	3064	Explorer.EXE	raserver.exe
PID 3064 wrote to memory of 4060	3064	Explorer.EXE	raserver.exe
PID 4060 wrote to memory of 5020	4060	raserver.exe	cmd.exe
PID 4060 wrote to memory of 5020	4060	raserver.exe	cmd.exe
PID 4060 wrote to memory of 5020	4060	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3064

C:\Users\Admin\AppData\Local\Temp\jetss4321.exe
"C:\Users\Admin\AppData\Local\Temp\jetss4321.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2100

C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"
3⤵
PID:5020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bqinymrhxf.yg
Filesize
5KB

MD5
1aaeec34da067db10371ba0d65bd2fdf

SHA1
ab511719298e745360040a627d96ddba9f5aa9c5

SHA256
1f0a4869a22601f432ba6b2630ee4b7b30d2a924cc18df5dda45ff89734c8931

SHA512
22f2a8db2a256d919144a299b49c8f59193255a2ac53eed793cff20996e79ffe26fd0266bce143128d95ca2dc4863e835540068a5e51895025bf664272defca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe
Filesize
6KB

MD5
4e60205c6fc0bbcb23c9ca921ec6729a

SHA1
a4b6d99ccab3feed7201d12afa33af49fee0375c

SHA256
09c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4

SHA512
688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dzotwnqy.hu
Filesize
185KB

MD5
3bea76e24c8cb495dee7e2a748025d30

SHA1
9f10de59f3dfb639e6fbe4236854fa73d6f78991

SHA256
765bed83e6d866446fcd3fe7398f97e889c21a57f6bb4c2bd552c48e1b074a32

SHA512
0a05cace5349e733526f51e2db95a794695fe71f8bcb645401a955d66dcd3d0b7af486df3572ad2fc9825d173edd243ffeab33e106abcead508c114c03c22592

Download Submit
memory/2100-132-0x0000000000000000-mapping.dmp

Download
memory/3064-142-0x0000000007AF0000-0x0000000007BCC000-memory.dmp

Filesize
880KB

Download
memory/3064-151-0x0000000008010000-0x0000000008186000-memory.dmp

Filesize
1.5MB

Download
memory/3064-149-0x0000000008010000-0x0000000008186000-memory.dmp

Filesize
1.5MB

Download
memory/4060-147-0x00000000024D0000-0x000000000281A000-memory.dmp

Filesize
3.3MB

Download
memory/4060-143-0x0000000000000000-mapping.dmp

Download
memory/4060-145-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4060-144-0x0000000000BB0000-0x0000000000BCF000-memory.dmp

Filesize
124KB

Download
memory/4060-148-0x0000000002210000-0x00000000022A3000-memory.dmp

Filesize
588KB

Download
memory/4060-150-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4164-141-0x0000000000E00000-0x0000000000E14000-memory.dmp

Filesize
80KB

Download
memory/4164-140-0x0000000001290000-0x00000000015DA000-memory.dmp

Filesize
3.3MB

Download
memory/4164-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4164-137-0x0000000000000000-mapping.dmp

Download
memory/5020-146-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads