formbook | 1e6327a5456f3aac77ec28cc80c9f9f8cff8a157a25a8a2f597764dcbccce3ea

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Confirmation!!.exe
Size

646KB
MD5

14b113f3a81cb3d3e896601fe247c31c
SHA1

5021223cb23d9a5d5598b2438ee08194d42edaf2
SHA256

1e6327a5456f3aac77ec28cc80c9f9f8cff8a157a25a8a2f597764dcbccce3ea
SHA512

96d6f8bd5135f9ad38e6042f3bdd30bbe08c877a779dcfbc8b7f5e0c4a142f8826ffc97ff0ee25d1863a380252ada31885217db6e0f89c3b19fb4acc9b2aa981
SSDEEP

12288:07AFnSTJ0TmqUmY/G6C7PgSMuE/5pTsKc/Q8VwNUmVGS:MqSTJ0TmrmY/VCB21C/Q8S3VGS

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4868-10-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4868-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/916-20-0x0000000000910000-0x000000000093F000-memory.dmp	formbook
behavioral2/memory/916-22-0x0000000000910000-0x000000000093F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3200 set thread context of 4868	3200	Confirmation!!.exe	96
PID 4868 set thread context of 3292	4868	Confirmation!!.exe	50
PID 916 set thread context of 3292	916	wscript.exe	50

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4868	Confirmation!!.exe
4868	Confirmation!!.exe
4868	Confirmation!!.exe
4868	Confirmation!!.exe
4868	Confirmation!!.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe
916	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3292	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4868	Confirmation!!.exe
4868	Confirmation!!.exe
4868	Confirmation!!.exe
916	wscript.exe
916	wscript.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	Confirmation!!.exe
Token: SeDebugPrivilege	916	wscript.exe
Token: SeManageVolumePrivilege	4640	svchost.exe
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3292	Explorer.EXE
3292	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3292	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4868	3200	Confirmation!!.exe	96
PID 3200 wrote to memory of 4868	3200	Confirmation!!.exe	96
PID 3200 wrote to memory of 4868	3200	Confirmation!!.exe	96
PID 3200 wrote to memory of 4868	3200	Confirmation!!.exe	96
PID 3200 wrote to memory of 4868	3200	Confirmation!!.exe	96
PID 3200 wrote to memory of 4868	3200	Confirmation!!.exe	96
PID 3292 wrote to memory of 916	3292	Explorer.EXE	97
PID 3292 wrote to memory of 916	3292	Explorer.EXE	97
PID 3292 wrote to memory of 916	3292	Explorer.EXE	97
PID 916 wrote to memory of 4760	916	wscript.exe	98
PID 916 wrote to memory of 4760	916	wscript.exe	98
PID 916 wrote to memory of 4760	916	wscript.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Users\Admin\AppData\Local\Temp\Confirmation!!.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirmation!!.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Confirmation!!.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirmation!!.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Confirmation!!.exe"
    3⤵
    PID:4760

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
83e074d0aecd20985dec37dcf8cb1b86

SHA1
9daa3dddca3725e786fd996f55ca8299cee56b34

SHA256
39dad4b2695a08a232923d489f5eb47b74c2805dda32ad12bc5f1e4bd4ab1c38

SHA512
9b36e11d3e05018fbfba9b55c982f6a79bdb1c23882b7175427ee86dfc07920fd14a550770a6547da19195ca0b45cb622f697b39337bad846aaa62b1d86d5bb1

Download Submit
memory/916-24-0x00000000028A0000-0x0000000002934000-memory.dmp

Filesize
592KB

Download
memory/916-22-0x0000000000910000-0x000000000093F000-memory.dmp

Filesize
188KB

Download
memory/916-21-0x0000000002950000-0x0000000002C9A000-memory.dmp

Filesize
3.3MB

Download
memory/916-20-0x0000000000910000-0x000000000093F000-memory.dmp

Filesize
188KB

Download
memory/916-19-0x0000000000DF0000-0x0000000000E17000-memory.dmp

Filesize
156KB

Download
memory/916-18-0x0000000000DF0000-0x0000000000E17000-memory.dmp

Filesize
156KB

Download
memory/3200-5-0x0000000005750000-0x000000000575A000-memory.dmp

Filesize
40KB

Download
memory/3200-4-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/3200-9-0x0000000009310000-0x00000000093AC000-memory.dmp

Filesize
624KB

Download
memory/3200-7-0x0000000005D20000-0x0000000005D2A000-memory.dmp

Filesize
40KB

Download
memory/3200-12-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/3200-0-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/3200-1-0x0000000000CA0000-0x0000000000D46000-memory.dmp

Filesize
664KB

Download
memory/3200-8-0x0000000006CD0000-0x0000000006D3E000-memory.dmp

Filesize
440KB

Download
memory/3200-2-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/3200-6-0x0000000005B00000-0x0000000005B16000-memory.dmp

Filesize
88KB

Download
memory/3200-3-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/3292-27-0x0000000003450000-0x000000000359A000-memory.dmp

Filesize
1.3MB

Download
memory/3292-26-0x0000000008F00000-0x0000000009003000-memory.dmp

Filesize
1.0MB

Download
memory/3292-17-0x0000000003450000-0x000000000359A000-memory.dmp

Filesize
1.3MB

Download
memory/3292-30-0x0000000008F00000-0x0000000009003000-memory.dmp

Filesize
1.0MB

Download
memory/3292-25-0x0000000008F00000-0x0000000009003000-memory.dmp

Filesize
1.0MB

Download
memory/4640-69-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-72-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-34-0x00000206D5B40000-0x00000206D5B50000-memory.dmp

Filesize
64KB

Download
memory/4640-50-0x00000206D5C40000-0x00000206D5C50000-memory.dmp

Filesize
64KB

Download
memory/4640-66-0x00000206DE230000-0x00000206DE231000-memory.dmp

Filesize
4KB

Download
memory/4640-67-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-70-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-74-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-76-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-75-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-73-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-80-0x00000206DDE80000-0x00000206DDE81000-memory.dmp

Filesize
4KB

Download
memory/4640-71-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-68-0x00000206DE250000-0x00000206DE251000-memory.dmp

Filesize
4KB

Download
memory/4640-78-0x00000206DDE70000-0x00000206DDE71000-memory.dmp

Filesize
4KB

Download
memory/4640-86-0x00000206DDDB0000-0x00000206DDDB1000-memory.dmp

Filesize
4KB

Download
memory/4640-101-0x00000206DDFC0000-0x00000206DDFC1000-memory.dmp

Filesize
4KB

Download
memory/4640-100-0x00000206DDFC0000-0x00000206DDFC1000-memory.dmp

Filesize
4KB

Download
memory/4640-98-0x00000206DDFB0000-0x00000206DDFB1000-memory.dmp

Filesize
4KB

Download
memory/4640-77-0x00000206DDE80000-0x00000206DDE81000-memory.dmp

Filesize
4KB

Download
memory/4640-83-0x00000206DDE70000-0x00000206DDE71000-memory.dmp

Filesize
4KB

Download
memory/4868-13-0x0000000001100000-0x000000000144A000-memory.dmp

Filesize
3.3MB

Download
memory/4868-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4868-16-0x0000000001450000-0x0000000001465000-memory.dmp

Filesize
84KB

Download
memory/4868-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download