formbook | ada5754083cc4ae90965d052f597238c41d7cd5e07564979e57d0dd5e0febc73

General

Target

Confirmal Receipt.exe
Size

908KB
MD5

78822d6789473c8dd4022a929bac7eaf
SHA1

dd39c2fb5bb0ace91191e6b326ba423664204f8a
SHA256

1e66c5f9e4058d0f9012f911400e6047664b009af6e16025425b9216a252e8ab
SHA512

8c38ebc4d33686dbc48931bac996ff3fea18544662ccc83c57ae7c3a7d7d0a6e30b4b2db2196414be7f1197a1972b7082d7810e52994348f1f0e9e6d2e1e3336
SSDEEP

24576:JttD/F2k78UYsFSJsRIt2UlD3Xx4/OwO:Jvgk78UzgCRIM6D3wOD

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral4/memory/2948-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral4/memory/2948-18-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral4/memory/4128-24-0x00000000006C0000-0x00000000006EF000-memory.dmp	formbook
behavioral4/memory/4128-26-0x00000000006C0000-0x00000000006EF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4556 set thread context of 2948	4556	Confirmal Receipt.exe	95
PID 2948 set thread context of 3100	2948	Confirmal Receipt.exe	58
PID 4128 set thread context of 3100	4128	explorer.exe	58

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2948	Confirmal Receipt.exe
2948	Confirmal Receipt.exe
2948	Confirmal Receipt.exe
2948	Confirmal Receipt.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe
4128	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3100	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2948	Confirmal Receipt.exe
2948	Confirmal Receipt.exe
2948	Confirmal Receipt.exe
4128	explorer.exe
4128	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	Confirmal Receipt.exe
Token: SeDebugPrivilege	4128	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3100	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2948	4556	Confirmal Receipt.exe	95
PID 4556 wrote to memory of 2948	4556	Confirmal Receipt.exe	95
PID 4556 wrote to memory of 2948	4556	Confirmal Receipt.exe	95
PID 4556 wrote to memory of 2948	4556	Confirmal Receipt.exe	95
PID 4556 wrote to memory of 2948	4556	Confirmal Receipt.exe	95
PID 4556 wrote to memory of 2948	4556	Confirmal Receipt.exe	95
PID 3100 wrote to memory of 4128	3100	Explorer.EXE	96
PID 3100 wrote to memory of 4128	3100	Explorer.EXE	96
PID 3100 wrote to memory of 4128	3100	Explorer.EXE	96
PID 4128 wrote to memory of 4324	4128	explorer.exe	97
PID 4128 wrote to memory of 4324	4128	explorer.exe	97
PID 4128 wrote to memory of 4324	4128	explorer.exe	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\Confirmal Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirmal Receipt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Confirmal Receipt.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirmal Receipt.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Confirmal Receipt.exe"
    3⤵
    PID:4324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-19-0x0000000000E20000-0x0000000000E35000-memory.dmp

Filesize
84KB

Download
memory/2948-16-0x00000000014A0000-0x00000000017EA000-memory.dmp

Filesize
3.3MB

Download
memory/2948-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2948-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3100-20-0x0000000009500000-0x0000000009691000-memory.dmp

Filesize
1.6MB

Download
memory/3100-34-0x0000000008F20000-0x0000000009080000-memory.dmp

Filesize
1.4MB

Download
memory/3100-31-0x0000000009500000-0x0000000009691000-memory.dmp

Filesize
1.6MB

Download
memory/3100-30-0x0000000008F20000-0x0000000009080000-memory.dmp

Filesize
1.4MB

Download
memory/3100-29-0x0000000008F20000-0x0000000009080000-memory.dmp

Filesize
1.4MB

Download
memory/4128-26-0x00000000006C0000-0x00000000006EF000-memory.dmp

Filesize
188KB

Download
memory/4128-21-0x0000000000FA0000-0x00000000013D3000-memory.dmp

Filesize
4.2MB

Download
memory/4128-23-0x0000000000FA0000-0x00000000013D3000-memory.dmp

Filesize
4.2MB

Download
memory/4128-24-0x00000000006C0000-0x00000000006EF000-memory.dmp

Filesize
188KB

Download
memory/4128-25-0x0000000002CA0000-0x0000000002FEA000-memory.dmp

Filesize
3.3MB

Download
memory/4128-28-0x00000000029E0000-0x0000000002A74000-memory.dmp

Filesize
592KB

Download
memory/4556-7-0x00000000081C0000-0x00000000081D8000-memory.dmp

Filesize
96KB

Download
memory/4556-15-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/4556-12-0x0000000008670000-0x000000000870C000-memory.dmp

Filesize
624KB

Download
memory/4556-11-0x0000000008560000-0x00000000085CE000-memory.dmp

Filesize
440KB

Download
memory/4556-10-0x0000000004E20000-0x0000000004E2A000-memory.dmp

Filesize
40KB

Download
memory/4556-9-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/4556-8-0x000000000A890000-0x000000000A896000-memory.dmp

Filesize
24KB

Download
memory/4556-0-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/4556-6-0x0000000005F80000-0x0000000005F8A000-memory.dmp

Filesize
40KB

Download
memory/4556-5-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/4556-4-0x00000000054E0000-0x0000000005834000-memory.dmp

Filesize
3.3MB

Download
memory/4556-3-0x00000000053B0000-0x0000000005442000-memory.dmp

Filesize
584KB

Download
memory/4556-2-0x00000000058B0000-0x0000000005E54000-memory.dmp

Filesize
5.6MB

Download
memory/4556-1-0x0000000000910000-0x00000000009F8000-memory.dmp

Filesize
928KB

Download

Analysis

Sharing