New FormBook Malware Targets Windows Users to Seize Full System Control

A newly discovered FormBook malware variant is actively targeting Microsoft Windows environments, employing a complex technical arsenal to achieve full remote control over infected endpoints.

The high-severity campaign, outlined in the latest threat analysis, demonstrates advanced techniques across initial compromise, payload delivery, execution, and command-and-control (C2) operations, making it a significant concern for enterprises and individual users alike.

FormBook Campaign Deployment

The infection chain begins with phishing emails exploiting the notorious CVE-2017-11882 vulnerability to deliver a malicious 64-bit DLL camouflaged within a fake PNG image.

Using process hollowing, the DLL maps and executes the FormBook payload within the legitimate “ImagingDevices.exe” process.

The actual payload, a re-encrypted 32-bit binary, is decrypted and launched via a custom routine that determines its true entry point dynamically during execution.

It deploys a duplicated instance of ntdll.dll, redirecting system API calls inside malware memory to complicate analysis.

APIs and module names are obfuscated as encrypted hashes, only decrypted just-in-time for execution, and then promptly re-encrypted, frustrating traditional static analysis tools.

The malware also scrutinizes system environments for telltale signs of virtual machines, sandboxes (e.g., Cuckoo, Sandboxie), and user or process names linked to research sandboxes, terminating itself if such artifacts are detected.

Anti-debug techniques include checks for user-mode and kernel-mode debuggers, alongside the use of the Heaven’s Gate technique to switch between 32-bit and 64-bit execution contexts, complicating efforts by analysts to follow its execution flow.

Process Hijacking

FormBook leverages a robust process hijacking scheme. It randomly identifies child processes of explorer.exe, such as notepad.exe, and injects a 64-bit code segment using shared memory and Heaven’s Gate transitions.

The main thread of the target process is suspended, a malicious payload is copied, and the instruction pointer is redirected to execute the injected code upon thread resumption.

According to Fortinet Report, this process is repeated to create new processes (e.g., PATHPING.EXE), into which the core FormBook dashboard is injected.

Once established, the FormBook payload aggressively harvests sensitive system information, browser credentials (Chrome, Firefox, Edge, and others), email account data, autofill fields, and clipboard contents.

The data is first encrypted and base64-encoded, then transmitted to one of over 60 obfuscated C2 domains via HTTP GET/POST requests through a dedicated socket process.

Notably, each C2 server is protected by a unique 0x14-byte encryption seed coupled with layered obfuscation.

The socket process continuously polls the C2 infrastructure for multi-layer encoded commands which, upon decryption, can instruct the malware to perform actions such as arbitrary file download and execution, self-deletion, data wiping, system reboot, and poweroff.

Control commands are highly modular, supporting plug-in execution (DLL, PS1, EXE), update mechanisms, and selective data theft or destruction.

This second-stage analysis of FormBook underlines the continually evolving sophistication of commodity malware.

Its anti-analysis, process injection, and system control features pose significant challenges to endpoint defense and forensic investigation.

Organizations are urged to ensure endpoint security solutions are up-to-date and to educate users on phishing risks.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.