formbook | c104d364eec79cad7a9c9040ff30d46e6b2bf694b3c8f80130bb599345fc3d76

General

Target

Confirm!!.exe
Size

857KB
MD5

1955205499dfe38428db18133d0c6281
SHA1

293c44a29a18f99a06fa38ec8d746d1ff19778b3
SHA256

c104d364eec79cad7a9c9040ff30d46e6b2bf694b3c8f80130bb599345fc3d76
SHA512

80e01e276e50faff6fcc014f182ee78ac65c158ce36b39577243f5b6cbd7d68beff76195c423aaa27d5d9ec5ca40e8f0b8a99a3418730043c4152102aa2f5d9a
SSDEEP

12288:7t4ucOMtEwcU3gZ+GQzjkATGdsp2EHiTZikOFBUif634eG8BSGlhWBr:ZTcO6AAgZbQzlGs2qiOFBUHo8B5Ux

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4492-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4492-141-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/5092-147-0x0000000000730000-0x000000000075F000-memory.dmp	formbook
behavioral2/memory/5092-152-0x0000000000730000-0x000000000075F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

Confirm!!.exeConfirm!!.exemsdt.exe

description	pid	process	target process
PID 3284 set thread context of 4492	3284	Confirm!!.exe	Confirm!!.exe
PID 4492 set thread context of 2056	4492	Confirm!!.exe	Explorer.EXE
PID 5092 set thread context of 2056	5092	msdt.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

Confirm!!.exeConfirm!!.exemsdt.exe

pid	process
3284	Confirm!!.exe
3284	Confirm!!.exe
4492	Confirm!!.exe
4492	Confirm!!.exe
4492	Confirm!!.exe
4492	Confirm!!.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe
5092	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2056 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Confirm!!.exemsdt.exe

pid process

4492 Confirm!!.exe
4492 Confirm!!.exe
4492 Confirm!!.exe
5092 msdt.exe
5092 msdt.exe

pid	process
2056	Explorer.EXE

pid	process
4492	Confirm!!.exe
4492	Confirm!!.exe
4492	Confirm!!.exe
5092	msdt.exe
5092	msdt.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

Confirm!!.exeConfirm!!.exemsdt.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3284	Confirm!!.exe
Token: SeDebugPrivilege	4492	Confirm!!.exe
Token: SeDebugPrivilege	5092	msdt.exe
Token: SeShutdownPrivilege	2056	Explorer.EXE
Token: SeCreatePagefilePrivilege	2056	Explorer.EXE
Token: SeShutdownPrivilege	2056	Explorer.EXE
Token: SeCreatePagefilePrivilege	2056	Explorer.EXE
Token: SeShutdownPrivilege	2056	Explorer.EXE
Token: SeCreatePagefilePrivilege	2056	Explorer.EXE
Token: SeShutdownPrivilege	2056	Explorer.EXE
Token: SeCreatePagefilePrivilege	2056	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Confirm!!.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 3284 wrote to memory of 4540	3284	Confirm!!.exe	Confirm!!.exe
PID 3284 wrote to memory of 4540	3284	Confirm!!.exe	Confirm!!.exe
PID 3284 wrote to memory of 4540	3284	Confirm!!.exe	Confirm!!.exe
PID 3284 wrote to memory of 4492	3284	Confirm!!.exe	Confirm!!.exe
PID 3284 wrote to memory of 4492	3284	Confirm!!.exe	Confirm!!.exe
PID 3284 wrote to memory of 4492	3284	Confirm!!.exe	Confirm!!.exe
PID 3284 wrote to memory of 4492	3284	Confirm!!.exe	Confirm!!.exe
PID 3284 wrote to memory of 4492	3284	Confirm!!.exe	Confirm!!.exe
PID 3284 wrote to memory of 4492	3284	Confirm!!.exe	Confirm!!.exe
PID 2056 wrote to memory of 5092	2056	Explorer.EXE	msdt.exe
PID 2056 wrote to memory of 5092	2056	Explorer.EXE	msdt.exe
PID 2056 wrote to memory of 5092	2056	Explorer.EXE	msdt.exe
PID 5092 wrote to memory of 2932	5092	msdt.exe	cmd.exe
PID 5092 wrote to memory of 2932	5092	msdt.exe	cmd.exe
PID 5092 wrote to memory of 2932	5092	msdt.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056

C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284

C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"
3⤵
PID:4540

C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"
3⤵
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-155-0x0000000002D80000-0x0000000002D90000-memory.dmp

Filesize
64KB

Download
memory/2056-159-0x0000000002D80000-0x0000000002D90000-memory.dmp

Filesize
64KB

Download
memory/2056-153-0x0000000008280000-0x0000000008404000-memory.dmp

Filesize
1.5MB

Download
memory/2056-154-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/2056-158-0x0000000002D80000-0x0000000002D90000-memory.dmp

Filesize
64KB

Download
memory/2056-160-0x0000000002D80000-0x0000000002D90000-memory.dmp

Filesize
64KB

Download
memory/2056-151-0x0000000008280000-0x0000000008404000-memory.dmp

Filesize
1.5MB

Download
memory/2056-156-0x0000000002D80000-0x0000000002D90000-memory.dmp

Filesize
64KB

Download
memory/2056-144-0x0000000008130000-0x0000000008271000-memory.dmp

Filesize
1.3MB

Download
memory/2056-157-0x0000000002D80000-0x0000000002D90000-memory.dmp

Filesize
64KB

Download
memory/2932-148-0x0000000000000000-mapping.dmp

Download
memory/3284-136-0x0000000007290000-0x000000000732C000-memory.dmp

Filesize
624KB

Download
memory/3284-132-0x00000000005E0000-0x00000000006BC000-memory.dmp

Filesize
880KB

Download
memory/3284-133-0x0000000005630000-0x0000000005BD4000-memory.dmp

Filesize
5.6MB

Download
memory/3284-135-0x0000000005040000-0x000000000504A000-memory.dmp

Filesize
40KB

Download
memory/3284-134-0x0000000005080000-0x0000000005112000-memory.dmp

Filesize
584KB

Download
memory/4492-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4492-143-0x00000000013B0000-0x00000000013C5000-memory.dmp

Filesize
84KB

Download
memory/4492-142-0x00000000018C0000-0x0000000001C0A000-memory.dmp

Filesize
3.3MB

Download
memory/4492-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4492-138-0x0000000000000000-mapping.dmp

Download
memory/4540-137-0x0000000000000000-mapping.dmp

Download
memory/5092-150-0x00000000028C0000-0x0000000002954000-memory.dmp

Filesize
592KB

Download
memory/5092-149-0x00000000029A0000-0x0000000002CEA000-memory.dmp

Filesize
3.3MB

Download
memory/5092-152-0x0000000000730000-0x000000000075F000-memory.dmp

Filesize
188KB

Download
memory/5092-147-0x0000000000730000-0x000000000075F000-memory.dmp

Filesize
188KB

Download
memory/5092-146-0x00000000001F0000-0x0000000000247000-memory.dmp

Filesize
348KB

Download
memory/5092-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads