formbook | bd9eeea5e3b56e0b6dfe7f745aed091c81a10e55a1504ea443bea0f44a9ff085

Analysis

max time kernel
161s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Confirm!!!!.exe
Size

670KB
MD5

b1ab7cccdb47e4b3e87b2c4055e203fa
SHA1

ca27b1b3639e8cb27d82310f95112b5021b8a653
SHA256

5931b9bb54cd619e0e0518c4e61654a3c154b59e72428698ea3f381cabaad213
SHA512

0a6344e74ae9f196ec5c6088660fe201658a1d168bf5795943565613fa358be6c8a55d1410ed76c7ac1b7ba538d4bce4fb7ace8eb00f6928df2a5a238cb4947f
SSDEEP

12288:5ebOcLHhFQd2zjpltAQBmlYTQM+wFiCGZ3wtaqwArx:UVYILmQBmxMJiutnx

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2016-10-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2016-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1244-21-0x0000000000350000-0x000000000037F000-memory.dmp	formbook
behavioral2/memory/1244-23-0x0000000000350000-0x000000000037F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 560 set thread context of 2016	560	Confirm!!!!.exe	100
PID 2016 set thread context of 3368	2016	Confirm!!!!.exe	47
PID 1244 set thread context of 3368	1244	rundll32.exe	47

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
2016	Confirm!!!!.exe
2016	Confirm!!!!.exe
2016	Confirm!!!!.exe
2016	Confirm!!!!.exe
2016	Confirm!!!!.exe
2016	Confirm!!!!.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2016	Confirm!!!!.exe
2016	Confirm!!!!.exe
2016	Confirm!!!!.exe
1244	rundll32.exe
1244	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	Confirm!!!!.exe
Token: SeDebugPrivilege	1244	rundll32.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3368	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2016	560	Confirm!!!!.exe	100
PID 560 wrote to memory of 2016	560	Confirm!!!!.exe	100
PID 560 wrote to memory of 2016	560	Confirm!!!!.exe	100
PID 560 wrote to memory of 2016	560	Confirm!!!!.exe	100
PID 560 wrote to memory of 2016	560	Confirm!!!!.exe	100
PID 560 wrote to memory of 2016	560	Confirm!!!!.exe	100
PID 3368 wrote to memory of 1244	3368	Explorer.EXE	101
PID 3368 wrote to memory of 1244	3368	Explorer.EXE	101
PID 3368 wrote to memory of 1244	3368	Explorer.EXE	101
PID 1244 wrote to memory of 2380	1244	rundll32.exe	104
PID 1244 wrote to memory of 2380	1244	rundll32.exe	104
PID 1244 wrote to memory of 2380	1244	rundll32.exe	104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Confirm!!!!.exe"
    3⤵
    PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-12-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/560-1-0x0000000000470000-0x000000000051E000-memory.dmp

Filesize
696KB

Download
memory/560-2-0x0000000005450000-0x00000000059F4000-memory.dmp

Filesize
5.6MB

Download
memory/560-3-0x0000000004F40000-0x0000000004FD2000-memory.dmp

Filesize
584KB

Download
memory/560-4-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/560-5-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/560-6-0x0000000005070000-0x0000000005082000-memory.dmp

Filesize
72KB

Download
memory/560-7-0x0000000005090000-0x000000000509E000-memory.dmp

Filesize
56KB

Download
memory/560-8-0x0000000006450000-0x00000000064BE000-memory.dmp

Filesize
440KB

Download
memory/560-9-0x00000000077C0000-0x000000000785C000-memory.dmp

Filesize
624KB

Download
memory/560-0-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/1244-21-0x0000000000350000-0x000000000037F000-memory.dmp

Filesize
188KB

Download
memory/1244-20-0x00000000004E0000-0x00000000004F4000-memory.dmp

Filesize
80KB

Download
memory/1244-25-0x00000000023B0000-0x0000000002444000-memory.dmp

Filesize
592KB

Download
memory/1244-23-0x0000000000350000-0x000000000037F000-memory.dmp

Filesize
188KB

Download
memory/1244-22-0x00000000024B0000-0x00000000027FA000-memory.dmp

Filesize
3.3MB

Download
memory/1244-18-0x00000000004E0000-0x00000000004F4000-memory.dmp

Filesize
80KB

Download
memory/2016-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2016-13-0x0000000001360000-0x00000000016AA000-memory.dmp

Filesize
3.3MB

Download
memory/2016-16-0x00000000011B0000-0x00000000011C5000-memory.dmp

Filesize
84KB

Download
memory/2016-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3368-17-0x0000000003420000-0x000000000354E000-memory.dmp

Filesize
1.2MB

Download
memory/3368-26-0x0000000008420000-0x0000000008566000-memory.dmp

Filesize
1.3MB

Download
memory/3368-27-0x0000000003420000-0x000000000354E000-memory.dmp

Filesize
1.2MB

Download
memory/3368-28-0x0000000008420000-0x0000000008566000-memory.dmp

Filesize
1.3MB

Download
memory/3368-31-0x0000000008420000-0x0000000008566000-memory.dmp

Filesize
1.3MB

Download