formbook | a8f5392112f282b9d32749631c3d85fc6b568dd0b3fe91ffb8c5c7215e3f7114

General

Target

SecuriteInfocomTrojanGene.exe
Size

261KB
MD5

b3368c7d14c040c8734d69b5bbc0c635
SHA1

d34224b8b7e01e22292a7eac678d337f00834a2b
SHA256

a8f5392112f282b9d32749631c3d85fc6b568dd0b3fe91ffb8c5c7215e3f7114
SHA512

5b036fe1a1650b8fbf03b2d4a91692ad271ce3a7fd572d6256e7b8aa71d9a8849b610865e782d2ab8566b7c44ee61af8965ab922d9e7ea552cb04734aee39c34
SSDEEP

3072:FJ2S2L6KbqDCwcrMEEKsmO39oW1jSAI+ltOJ7y4UjjiJ0bUSgSBQ8QNn9lmDe5+W:F8LxBszXOyrSJm/bQN9laFexrODdtKRf

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2888-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2888-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2888-74-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/872-79-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/872-81-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2264 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

SecuriteInfocomTrojanGene.exe

pid process

2384 SecuriteInfocomTrojanGene.exe

pid	process
2264	cmd.exe

pid	process
2384	SecuriteInfocomTrojanGene.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

SecuriteInfocomTrojanGene.exeSecuriteInfocomTrojanGene.exemstsc.exe

description	pid	process	target process
PID 2384 set thread context of 2888	2384	SecuriteInfocomTrojanGene.exe	SecuriteInfocomTrojanGene.exe
PID 2888 set thread context of 1196	2888	SecuriteInfocomTrojanGene.exe	Explorer.EXE
PID 2888 set thread context of 1196	2888	SecuriteInfocomTrojanGene.exe	Explorer.EXE
PID 872 set thread context of 1196	872	mstsc.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

SecuriteInfocomTrojanGene.exemstsc.exe

pid	process
2888	SecuriteInfocomTrojanGene.exe
2888	SecuriteInfocomTrojanGene.exe
2888	SecuriteInfocomTrojanGene.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe
872	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE

pid	process
1196	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

SecuriteInfocomTrojanGene.exemstsc.exe

pid	process
2888	SecuriteInfocomTrojanGene.exe
2888	SecuriteInfocomTrojanGene.exe
2888	SecuriteInfocomTrojanGene.exe
2888	SecuriteInfocomTrojanGene.exe
872	mstsc.exe
872	mstsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfocomTrojanGene.exemstsc.exe

description pid process

Token: SeDebugPrivilege 2888 SecuriteInfocomTrojanGene.exe
Token: SeDebugPrivilege 872 mstsc.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
1196 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
1196 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2888	SecuriteInfocomTrojanGene.exe
Token: SeDebugPrivilege	872	mstsc.exe

pid	process
1196	Explorer.EXE
1196	Explorer.EXE

pid	process
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SecuriteInfocomTrojanGene.exeSecuriteInfocomTrojanGene.exemstsc.exe

description	pid	process	target process
PID 2384 wrote to memory of 2888	2384	SecuriteInfocomTrojanGene.exe	SecuriteInfocomTrojanGene.exe
PID 2384 wrote to memory of 2888	2384	SecuriteInfocomTrojanGene.exe	SecuriteInfocomTrojanGene.exe
PID 2384 wrote to memory of 2888	2384	SecuriteInfocomTrojanGene.exe	SecuriteInfocomTrojanGene.exe
PID 2384 wrote to memory of 2888	2384	SecuriteInfocomTrojanGene.exe	SecuriteInfocomTrojanGene.exe
PID 2384 wrote to memory of 2888	2384	SecuriteInfocomTrojanGene.exe	SecuriteInfocomTrojanGene.exe
PID 2384 wrote to memory of 2888	2384	SecuriteInfocomTrojanGene.exe	SecuriteInfocomTrojanGene.exe
PID 2384 wrote to memory of 2888	2384	SecuriteInfocomTrojanGene.exe	SecuriteInfocomTrojanGene.exe
PID 2888 wrote to memory of 872	2888	SecuriteInfocomTrojanGene.exe	mstsc.exe
PID 2888 wrote to memory of 872	2888	SecuriteInfocomTrojanGene.exe	mstsc.exe
PID 2888 wrote to memory of 872	2888	SecuriteInfocomTrojanGene.exe	mstsc.exe
PID 2888 wrote to memory of 872	2888	SecuriteInfocomTrojanGene.exe	mstsc.exe
PID 872 wrote to memory of 2264	872	mstsc.exe	cmd.exe
PID 872 wrote to memory of 2264	872	mstsc.exe	cmd.exe
PID 872 wrote to memory of 2264	872	mstsc.exe	cmd.exe
PID 872 wrote to memory of 2264	872	mstsc.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196

C:\Users\Admin\AppData\Local\Temp\SecuriteInfocomTrojanGene.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfocomTrojanGene.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2384

C:\Users\Admin\AppData\Local\Temp\SecuriteInfocomTrojanGene.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfocomTrojanGene.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
4⤵
PID:2052

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\SecuriteInfocomTrojanGene.exe"
5⤵
- Deletes itself
PID:2264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj5A52.tmp\bvxzu.dll
Filesize
47KB

MD5
ea41f063d08a24c992a9db51ebd1fd7f

SHA1
f28dda174cb32acfdc47cae0a101de53ab78d3a4

SHA256
9b51a7156f242aaafb43c7ca8b5ff9547643a747e4a672d06669aec9a29b28ee

SHA512
ca7875967878aae950a48b1e149154d6181813717317cb3cb2ab95bff729e115d88b838912021c73f67cdf09fa30aa6a469b153a43e63f348613eb341d8bab58

Download Submit
\Users\Admin\AppData\Local\Temp\nsj5A52.tmp\bvxzu.dll
Filesize
47KB

MD5
ea41f063d08a24c992a9db51ebd1fd7f

SHA1
f28dda174cb32acfdc47cae0a101de53ab78d3a4

SHA256
9b51a7156f242aaafb43c7ca8b5ff9547643a747e4a672d06669aec9a29b28ee

SHA512
ca7875967878aae950a48b1e149154d6181813717317cb3cb2ab95bff729e115d88b838912021c73f67cdf09fa30aa6a469b153a43e63f348613eb341d8bab58

Download Submit
memory/872-82-0x0000000001F10000-0x0000000001FA4000-memory.dmp

Filesize
592KB

Download
memory/872-81-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/872-80-0x00000000020A0000-0x00000000023A3000-memory.dmp

Filesize
3.0MB

Download
memory/872-79-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/872-78-0x0000000000A00000-0x0000000000B04000-memory.dmp

Filesize
1.0MB

Download
memory/872-76-0x0000000000A00000-0x0000000000B04000-memory.dmp

Filesize
1.0MB

Download
memory/1196-73-0x0000000006650000-0x000000000673F000-memory.dmp

Filesize
956KB

Download
memory/1196-69-0x00000000062C0000-0x0000000006426000-memory.dmp

Filesize
1.4MB

Download
memory/1196-84-0x0000000006DA0000-0x0000000006EAC000-memory.dmp

Filesize
1.0MB

Download
memory/1196-85-0x0000000006DA0000-0x0000000006EAC000-memory.dmp

Filesize
1.0MB

Download
memory/1196-87-0x0000000006DA0000-0x0000000006EAC000-memory.dmp

Filesize
1.0MB

Download
memory/2384-64-0x0000000074720000-0x0000000074730000-memory.dmp

Filesize
64KB

Download
memory/2384-61-0x0000000074720000-0x0000000074730000-memory.dmp

Filesize
64KB

Download
memory/2888-72-0x00000000004C0000-0x00000000004D5000-memory.dmp

Filesize
84KB

Download
memory/2888-74-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2888-68-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2888-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2888-66-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download
memory/2888-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads