formbook | 881dc085a9c46e3e31ad8189720dc6e16a7f3b40a6de30d6cadd088c0f769bec

General

Target

anthony.exe
Size

389KB
MD5

aa078a3e0ae224567676780e445d0987
SHA1

1a41de109b5ffc1b76d88435e4c1b86d6014361f
SHA256

881dc085a9c46e3e31ad8189720dc6e16a7f3b40a6de30d6cadd088c0f769bec
SHA512

28601887427c5a7eaf6e260fa858599030b91a5fc5643abbdca28081ef59747be591690f3f7ee27f4f63af8b389367ccfc440f1f7bcd8ff51497c6572251bc0e

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.wellnesspharma.net/94sb/

Decoy

kaligao.com

springsbounce.com

dreamytree.com

trylolows.com

butload.info

creperie-pancakesquare.com

mirajions.com

joineduphealthresources.net

hamradioblogs.com

linghuidz.com

atelierzeste.com

tweens.network

perteprampram03.net

connorneill.com

nannatech.com

chrmo.com

nanoring.info

mapomarket.com

bongkey.com

sdhhzp.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1264-6-0x00000000006F0000-0x0000000000719000-memory.dmp	xloader
behavioral1/memory/1444-7-0x0000000000000000-mapping.dmp	xloader
behavioral1/memory/668-9-0x0000000000000000-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1264 rundll32.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

cmd.exeraserver.exe

description	pid	process	target process
PID 1444 set thread context of 1236	1444	cmd.exe	Explorer.EXE
PID 1444 set thread context of 1236	1444	cmd.exe	Explorer.EXE
PID 668 set thread context of 1236	668	raserver.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

rundll32.execmd.exeraserver.exe

pid	process
1264	rundll32.exe
1264	rundll32.exe
1444	cmd.exe
1444	cmd.exe
1444	cmd.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe
668	raserver.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

rundll32.execmd.exeraserver.exe

pid process

1264 rundll32.exe
1264 rundll32.exe
1444 cmd.exe
1444 cmd.exe
1444 cmd.exe
1444 cmd.exe
668 raserver.exe
668 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exeraserver.exe

description pid process

Token: SeDebugPrivilege 1444 cmd.exe
Token: SeDebugPrivilege 668 raserver.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1444	cmd.exe
Token: SeDebugPrivilege	668	raserver.exe

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

anthony.exerundll32.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 1084 wrote to memory of 1264	1084	anthony.exe	rundll32.exe
PID 1084 wrote to memory of 1264	1084	anthony.exe	rundll32.exe
PID 1084 wrote to memory of 1264	1084	anthony.exe	rundll32.exe
PID 1084 wrote to memory of 1264	1084	anthony.exe	rundll32.exe
PID 1084 wrote to memory of 1264	1084	anthony.exe	rundll32.exe
PID 1084 wrote to memory of 1264	1084	anthony.exe	rundll32.exe
PID 1084 wrote to memory of 1264	1084	anthony.exe	rundll32.exe
PID 1264 wrote to memory of 1520	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1520	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1520	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1520	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1520	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1264 wrote to memory of 1444	1264	rundll32.exe	cmd.exe
PID 1236 wrote to memory of 668	1236	Explorer.EXE	raserver.exe
PID 1236 wrote to memory of 668	1236	Explorer.EXE	raserver.exe
PID 1236 wrote to memory of 668	1236	Explorer.EXE	raserver.exe
PID 1236 wrote to memory of 668	1236	Explorer.EXE	raserver.exe
PID 668 wrote to memory of 1052	668	raserver.exe	cmd.exe
PID 668 wrote to memory of 1052	668	raserver.exe	cmd.exe
PID 668 wrote to memory of 1052	668	raserver.exe	cmd.exe
PID 668 wrote to memory of 1052	668	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\anthony.exe
  "C:\Users\Admin\AppData\Local\Temp\anthony.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe Formicarium,Chechako
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1444
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\cmd.exe"
    3⤵
    PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Formicarium.DLL

MD5
615c2b05240c4cc08eb974142adb4b48

SHA1
4c1d31132e20a11f5fa77f78f8d353f00871a82e

SHA256
e3941182b18c301a9b108bf22b9b76c153fc633017799e472a701cefbaaef260

SHA512
c14e36a1cfd037a7af3200ec97394409396b3b07f5a10ec72b61a2052346d215adf6403246ab9f5b980b61cf011a982edf7791e6828083bbd536cb8264361c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Oenomel

MD5
4c17a43455fe2c1b3e13643ce40c6289

SHA1
6a35ee24e502632f4b247425acfbb8937ed0c6c7

SHA256
93a9368167223906271bc361fcb6e6d21239f30ce5ea94fc4cf601b2c382bc88

SHA512
e4dae063f0a90f93e05b9733ec3cc38d59b1bb3299df2d2c72ae173db5fe786e876153e588ac2896012597c3175d0431bbe3aed0d4e6a8dbd93b1efedd0d982f

Download Submit
\Users\Admin\AppData\Local\Temp\Formicarium.dll

MD5
615c2b05240c4cc08eb974142adb4b48

SHA1
4c1d31132e20a11f5fa77f78f8d353f00871a82e

SHA256
e3941182b18c301a9b108bf22b9b76c153fc633017799e472a701cefbaaef260

SHA512
c14e36a1cfd037a7af3200ec97394409396b3b07f5a10ec72b61a2052346d215adf6403246ab9f5b980b61cf011a982edf7791e6828083bbd536cb8264361c03

Download Submit
memory/668-9-0x0000000000000000-mapping.dmp

Download
memory/668-10-0x00000000006F0000-0x000000000070C000-memory.dmp

Filesize
112KB

Download
memory/668-12-0x0000000004100000-0x0000000004231000-memory.dmp

Filesize
1.2MB

Download
memory/1052-11-0x0000000000000000-mapping.dmp

Download
memory/1236-8-0x0000000006560000-0x00000000066BB000-memory.dmp

Filesize
1.4MB

Download
memory/1264-2-0x0000000000000000-mapping.dmp

Download
memory/1264-6-0x00000000006F0000-0x0000000000719000-memory.dmp

Filesize
164KB

Download
memory/1444-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads