formbook | bd9eeea5e3b56e0b6dfe7f745aed091c81a10e55a1504ea443bea0f44a9ff085

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Confirm!!!!.exe
Size

670KB
MD5

b1ab7cccdb47e4b3e87b2c4055e203fa
SHA1

ca27b1b3639e8cb27d82310f95112b5021b8a653
SHA256

5931b9bb54cd619e0e0518c4e61654a3c154b59e72428698ea3f381cabaad213
SHA512

0a6344e74ae9f196ec5c6088660fe201658a1d168bf5795943565613fa358be6c8a55d1410ed76c7ac1b7ba538d4bce4fb7ace8eb00f6928df2a5a238cb4947f
SSDEEP

12288:5ebOcLHhFQd2zjpltAQBmlYTQM+wFiCGZ3wtaqwArx:UVYILmQBmxMJiutnx

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2572-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2572	2964	Confirm!!!!.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	2572	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2964	Confirm!!!!.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	Confirm!!!!.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2844	2964	Confirm!!!!.exe	28
PID 2964 wrote to memory of 2844	2964	Confirm!!!!.exe	28
PID 2964 wrote to memory of 2844	2964	Confirm!!!!.exe	28
PID 2964 wrote to memory of 2844	2964	Confirm!!!!.exe	28
PID 2964 wrote to memory of 2572	2964	Confirm!!!!.exe	29
PID 2964 wrote to memory of 2572	2964	Confirm!!!!.exe	29
PID 2964 wrote to memory of 2572	2964	Confirm!!!!.exe	29
PID 2964 wrote to memory of 2572	2964	Confirm!!!!.exe	29
PID 2964 wrote to memory of 2572	2964	Confirm!!!!.exe	29
PID 2964 wrote to memory of 2572	2964	Confirm!!!!.exe	29
PID 2964 wrote to memory of 2572	2964	Confirm!!!!.exe	29
PID 2572 wrote to memory of 2700	2572	Confirm!!!!.exe	30
PID 2572 wrote to memory of 2700	2572	Confirm!!!!.exe	30
PID 2572 wrote to memory of 2700	2572	Confirm!!!!.exe	30
PID 2572 wrote to memory of 2700	2572	Confirm!!!!.exe	30

C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe"
  2⤵
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 36
    3⤵
    - Program crash
    PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2572-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2572-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2572-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2964-1-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-0-0x0000000000AC0000-0x0000000000B6E000-memory.dmp

Filesize
696KB

Download
memory/2964-2-0x0000000000490000-0x00000000004D0000-memory.dmp

Filesize
256KB

Download
memory/2964-3-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/2964-4-0x0000000000430000-0x000000000043E000-memory.dmp

Filesize
56KB

Download
memory/2964-5-0x0000000004DA0000-0x0000000004E0E000-memory.dmp

Filesize
440KB

Download
memory/2964-12-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download