formbook | 9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd

General

Target
6rR1G3EcvT3djII.exe
Size 497KB
Sample201208-efee1fc7cs
SHA256 9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd
MD5 02eebb83231ac8e4ec8ced427b7a64a4
SHA1 5354a0047e2a26e0e7829ece3ba223478c490dda
SHA512 28dc4d300617129da2cb70a9659b39be497b61dadd7703584d6a9deff35ddbea0ac34c7d2fe9172b03523bed01f2bd768d4200970d95ba2a160d38a6b239eac4
MD5 SHA1 SHA512

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.foundyourhuman.info/onga/

Decoy

ethdrop.online
insurancewithchad.com
magenx2.info
kunwarrishabh.com
infiniteshinedetailing.com
purebal.com
ebaysuspensions.com
beauchampedinburgh.com
freetopraiseradio.com
thomasdelaunay.com
northatlanticfutsal.com
thetradegrowth.com
mamunakand.com
ma7aby.com
bigsalesdeals.com
holoweb.network
nutrajoy.cheap
supremetrainer.com
mengxiang28.com
behavioralhealthagency.net
hodlerwallet.com
czyouxing.com
strengthseed.com
colorsplash.xyz
classonlinepy.com
bestfraseology.com
connectgf.com
royalhairculture.com
jatayuadventurecenter.com
alarmatics.com
hijabazzura.com
noitrechobe.online
video4pc.com
lapdatmangviettelhcm.net
thueringer-rechenzentrum.com
rivercitycharter.com
jrcatbgroup.com
theleaderpain.com
borderlesswc.com
parkuload.com
earthsflavour.com
northernirelandmusictherapy.com
messiahhomes.com
goiquatangchipi.com
starduster1.com
thewokelazyman.com
lok-katha.com
lukavingad.com
mucunamedicalfood.com
lobikomarket.com
lopolics.com
premier-bookkeeping.com
immigrantathome.com
lunos.net
nalogsite.space
escueladearboristas.com
amberissa.com
handcraftedbyjewell.com
freetextboos.com
clingnseal.com
12726caswell.com
flourishotuedon.com
amd.red
workcloud24.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1648-7-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1648-8-0x000000000041D0F0-mapping.dmp	xloader
behavioral1/memory/980-9-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

pid	Process
820	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 1648	1408	6rR1G3EcvT3djII.exe	30
PID 1648 set thread context of 1276	1648	6rR1G3EcvT3djII.exe	10
PID 1648 set thread context of 1276	1648	6rR1G3EcvT3djII.exe	10
PID 980 set thread context of 1276	980	raserver.exe	10

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1408	6rR1G3EcvT3djII.exe
1408	6rR1G3EcvT3djII.exe
1648	6rR1G3EcvT3djII.exe
1648	6rR1G3EcvT3djII.exe
1648	6rR1G3EcvT3djII.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe
980	raserver.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1648	6rR1G3EcvT3djII.exe
1648	6rR1G3EcvT3djII.exe
1648	6rR1G3EcvT3djII.exe
1648	6rR1G3EcvT3djII.exe
980	raserver.exe
980	raserver.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	6rR1G3EcvT3djII.exe
Token: SeDebugPrivilege	1648	6rR1G3EcvT3djII.exe
Token: SeDebugPrivilege	980	raserver.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1668	1408	6rR1G3EcvT3djII.exe	29
PID 1408 wrote to memory of 1668	1408	6rR1G3EcvT3djII.exe	29
PID 1408 wrote to memory of 1668	1408	6rR1G3EcvT3djII.exe	29
PID 1408 wrote to memory of 1668	1408	6rR1G3EcvT3djII.exe	29
PID 1408 wrote to memory of 1648	1408	6rR1G3EcvT3djII.exe	30
PID 1408 wrote to memory of 1648	1408	6rR1G3EcvT3djII.exe	30
PID 1408 wrote to memory of 1648	1408	6rR1G3EcvT3djII.exe	30
PID 1408 wrote to memory of 1648	1408	6rR1G3EcvT3djII.exe	30
PID 1408 wrote to memory of 1648	1408	6rR1G3EcvT3djII.exe	30
PID 1408 wrote to memory of 1648	1408	6rR1G3EcvT3djII.exe	30
PID 1408 wrote to memory of 1648	1408	6rR1G3EcvT3djII.exe	30
PID 1276 wrote to memory of 980	1276	Explorer.EXE	31
PID 1276 wrote to memory of 980	1276	Explorer.EXE	31
PID 1276 wrote to memory of 980	1276	Explorer.EXE	31
PID 1276 wrote to memory of 980	1276	Explorer.EXE	31
PID 980 wrote to memory of 820	980	raserver.exe	32
PID 980 wrote to memory of 820	980	raserver.exe	32
PID 980 wrote to memory of 820	980	raserver.exe	32
PID 980 wrote to memory of 820	980	raserver.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\6rR1G3EcvT3djII.exe
  "C:\Users\Admin\AppData\Local\Temp\6rR1G3EcvT3djII.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Users\Admin\AppData\Local\Temp\6rR1G3EcvT3djII.exe
    "{path}"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\6rR1G3EcvT3djII.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\6rR1G3EcvT3djII.exe"
    3⤵
    - Deletes itself
    PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-10-0x0000000000820000-0x000000000083C000-memory.dmp

Download

memory/980-12-0x0000000004000000-0x00000000040D3000-memory.dmp

Download

memory/1408-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download

memory/1408-3-0x00000000000E0000-0x00000000000E1000-memory.dmp

Download

memory/1408-5-0x0000000000450000-0x000000000045E000-memory.dmp

Download

memory/1408-6-0x0000000005450000-0x00000000054BF000-memory.dmp

Download

memory/1648-7-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads