formbook | b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530

General

Target
90508db9aa3b3698eb08109217eb43b7.exe
Size 1.0MB
Sample201210-8s8qaddvyn
SHA256 b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530
MD5 90508db9aa3b3698eb08109217eb43b7
SHA1 f443522186cad995be2fce64a377bb1e01b49250
SHA512 34f683a79d9bcef09a77dd2edf85015b540fd55cb2c709daa7363fa70518f30a6c99d48de7424ef551b8b13ce96dc6a472c319f1eddec2b4acaf2d0d8fb2f4aa
MD5 SHA1 SHA512

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.switchtoambitwithmirtha.com/jskg/

Decoy

jajaten.com
pnorg.net
rccarquibogota.com
marcomarabiamea.com
theligue.com
mdearpet.com
barokahsrivillage.com
wisdomtoothguru.com
srteamsex.com
erotictoybox.com
278698.com
victimaccidents.com
bootyfashions.com
stomasto.site
canalysisconsulting.com
printandmail.legal
bestcureforbackpain.com
apanifitness.com
smartabletech.com
facialsteamerofficial.com
cookclassesfishes.com
ayanmobile.com
cannapharmaus.com
lactationdrink.com
enrgsystems.info
f1leghecodemasters.net
topazkibblez.com
appbecause.com
256barrington.com
snapmoneyexchangellc.com
kriolland.com
7255399.com
realoneathletics.info
illustriousevents.com
moonman.services
dog2meeting.com
successwithyolandafgreen.com
freshlookconsulting.net
3bcreditwatch.com
lacroixundkress.com
beaujolaisboston.com
breakawayfc.com
bollmasonry.com
jiujitsuspa.com
zirangaobai.com
capitalmedicalsupplies.net
swavhca.com
pereiranatalia.com
lbarco.com
revistabrasileiramarketing.info
carportaccessory.com
kvrkl.com
handledlife.com
groups-post-sales-2678493.xyz
rapidprintz.com
buzzkeel.com
divinityemerald.com
ppc-listing.info
coryfireshop.com
mimipopuppicnics.com
votehealey.com
saraadamchak.com
winwinwin365.net
tprmt.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/992-8-0x000000000053164C-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 992	800	90508db9aa3b3698eb08109217eb43b7.exe	31

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	90508db9aa3b3698eb08109217eb43b7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	90508db9aa3b3698eb08109217eb43b7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	90508db9aa3b3698eb08109217eb43b7.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
992	90508db9aa3b3698eb08109217eb43b7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 992	800	90508db9aa3b3698eb08109217eb43b7.exe	31
PID 800 wrote to memory of 992	800	90508db9aa3b3698eb08109217eb43b7.exe	31
PID 800 wrote to memory of 992	800	90508db9aa3b3698eb08109217eb43b7.exe	31
PID 800 wrote to memory of 992	800	90508db9aa3b3698eb08109217eb43b7.exe	31
PID 800 wrote to memory of 992	800	90508db9aa3b3698eb08109217eb43b7.exe	31
PID 800 wrote to memory of 992	800	90508db9aa3b3698eb08109217eb43b7.exe	31

C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe
"C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe
  "C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-4-0x000007FEF7C70000-0x000007FEF7EEA000-memory.dmp

Download

memory/800-2-0x0000000001D40000-0x0000000001DA5000-memory.dmp

Download

memory/800-5-0x00000000043B0000-0x00000000043FC000-memory.dmp

Download

memory/992-7-0x0000000000530000-0x000000000055B000-memory.dmp

Download

memory/992-9-0x0000000000530000-0x000000000055B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads