formbook | c104d364eec79cad7a9c9040ff30d46e6b2bf694b3c8f80130bb599345fc3d76

General

Target

Confirm!!.exe
Size

857KB
MD5

1955205499dfe38428db18133d0c6281
SHA1

293c44a29a18f99a06fa38ec8d746d1ff19778b3
SHA256

c104d364eec79cad7a9c9040ff30d46e6b2bf694b3c8f80130bb599345fc3d76
SHA512

80e01e276e50faff6fcc014f182ee78ac65c158ce36b39577243f5b6cbd7d68beff76195c423aaa27d5d9ec5ca40e8f0b8a99a3418730043c4152102aa2f5d9a
SSDEEP

12288:7t4ucOMtEwcU3gZ+GQzjkATGdsp2EHiTZikOFBUif634eG8BSGlhWBr:ZTcO6AAgZbQzlGs2qiOFBUHo8B5Ux

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/320-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/320-64-0x000000000041F080-mapping.dmp	formbook
behavioral1/memory/320-66-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1920-73-0x0000000000070000-0x000000000009F000-memory.dmp	formbook
behavioral1/memory/1920-78-0x0000000000070000-0x000000000009F000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

Processes:

cscript.exe

flow pid process

11 1920 cscript.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1500 cmd.exe

flow	pid	process
11	1920	cscript.exe

pid	process
1500	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Confirm!!.exeConfirm!!.execscript.exe

description	pid	process	target process
PID 1244 set thread context of 320	1244	Confirm!!.exe	Confirm!!.exe
PID 320 set thread context of 1224	320	Confirm!!.exe	Explorer.EXE
PID 1920 set thread context of 1224	1920	cscript.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

Confirm!!.execscript.exe

pid	process
320	Confirm!!.exe
320	Confirm!!.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe
1920	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1224 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Confirm!!.execscript.exe

pid process

320 Confirm!!.exe
320 Confirm!!.exe
320 Confirm!!.exe
1920 cscript.exe
1920 cscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Confirm!!.execscript.exe

description pid process

Token: SeDebugPrivilege 320 Confirm!!.exe
Token: SeDebugPrivilege 1920 cscript.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1224 Explorer.EXE
1224 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1224 Explorer.EXE
1224 Explorer.EXE

pid	process
1224	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	320	Confirm!!.exe
Token: SeDebugPrivilege	1920	cscript.exe

pid	process
1224	Explorer.EXE
1224	Explorer.EXE

pid	process
1224	Explorer.EXE
1224	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Confirm!!.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 1244 wrote to memory of 320	1244	Confirm!!.exe	Confirm!!.exe
PID 1244 wrote to memory of 320	1244	Confirm!!.exe	Confirm!!.exe
PID 1244 wrote to memory of 320	1244	Confirm!!.exe	Confirm!!.exe
PID 1244 wrote to memory of 320	1244	Confirm!!.exe	Confirm!!.exe
PID 1244 wrote to memory of 320	1244	Confirm!!.exe	Confirm!!.exe
PID 1244 wrote to memory of 320	1244	Confirm!!.exe	Confirm!!.exe
PID 1244 wrote to memory of 320	1244	Confirm!!.exe	Confirm!!.exe
PID 1224 wrote to memory of 1920	1224	Explorer.EXE	cscript.exe
PID 1224 wrote to memory of 1920	1224	Explorer.EXE	cscript.exe
PID 1224 wrote to memory of 1920	1224	Explorer.EXE	cscript.exe
PID 1224 wrote to memory of 1920	1224	Explorer.EXE	cscript.exe
PID 1920 wrote to memory of 1500	1920	cscript.exe	cmd.exe
PID 1920 wrote to memory of 1500	1920	cscript.exe	cmd.exe
PID 1920 wrote to memory of 1500	1920	cscript.exe	cmd.exe
PID 1920 wrote to memory of 1500	1920	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"
3⤵
- Deletes itself
PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/320-68-0x0000000000270000-0x0000000000285000-memory.dmp

Filesize
84KB

Download
memory/320-67-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download
memory/320-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/320-64-0x000000000041F080-mapping.dmp

Download
memory/320-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/320-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1224-69-0x00000000063E0000-0x00000000064E7000-memory.dmp

Filesize
1.0MB

Download
memory/1224-76-0x00000000064F0000-0x0000000006631000-memory.dmp

Filesize
1.3MB

Download
memory/1224-79-0x00000000064F0000-0x0000000006631000-memory.dmp

Filesize
1.3MB

Download
memory/1224-77-0x00000000063E0000-0x00000000064E7000-memory.dmp

Filesize
1.0MB

Download
memory/1244-54-0x0000000000FA0000-0x000000000107C000-memory.dmp

Filesize
880KB

Download
memory/1244-59-0x0000000004D20000-0x0000000004D54000-memory.dmp

Filesize
208KB

Download
memory/1244-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download
memory/1244-56-0x0000000000530000-0x0000000000540000-memory.dmp

Filesize
64KB

Download
memory/1244-57-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/1244-58-0x0000000005F10000-0x0000000005F80000-memory.dmp

Filesize
448KB

Download
memory/1500-71-0x0000000000000000-mapping.dmp

Download
memory/1920-70-0x0000000000000000-mapping.dmp

Download
memory/1920-72-0x00000000000A0000-0x00000000000C2000-memory.dmp

Filesize
136KB

Download
memory/1920-73-0x0000000000070000-0x000000000009F000-memory.dmp

Filesize
188KB

Download
memory/1920-74-0x0000000001F70000-0x0000000002273000-memory.dmp

Filesize
3.0MB

Download
memory/1920-75-0x0000000002280000-0x0000000002314000-memory.dmp

Filesize
592KB

Download
memory/1920-78-0x0000000000070000-0x000000000009F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads