formbook | 6526a7eed94f5bff8a1c8b3d9d0aca202b72102edb7beec08644ff9ba06e00e2

Analysis

Target
Consignment Details.exe
Size 194KB
Sample201210-rxwxvqcgn6
SHA256 6526a7eed94f5bff8a1c8b3d9d0aca202b72102edb7beec08644ff9ba06e00e2
MD5 b0fc8a096f32d026dd685bbf1a6abf50
SHA1 28ea752d2f13934fde381a85647dfc368f909372
SHA512 dd8585dc113ff8ec153a8f0e4e5392c02e8bcd67c90a5f0eab78f1706256b1ae3329268faf5b5b4f6127fc48cbd8372f81eb2f8b4c4f91ce2b8dbe9d073e380e
MD5 SHA1 SHA512

Score

10^/10

Family

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1992-2-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1992-3-0x000000000041D0D0-mapping.dmp	xloader
behavioral2/memory/3432-6-0x0000000000000000-mapping.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 1992	4052	Consignment Details.exe	75
PID 1992 set thread context of 3028	1992	Consignment Details.exe	21
PID 3432 set thread context of 3028	3432	msdt.exe	21

Suspicious behavior: EnumeratesProcesses 62 IoCs

Suspicious behavior: MapViewOfSection 6 IoCs

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	Consignment Details.exe
Token: SeDebugPrivilege	3432	msdt.exe
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE
Token: SeShutdownPrivilege	3028	Explorer.EXE
Token: SeCreatePagefilePrivilege	3028	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3028	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 1992	4052	Consignment Details.exe	75
PID 4052 wrote to memory of 1992	4052	Consignment Details.exe	75
PID 4052 wrote to memory of 1992	4052	Consignment Details.exe	75
PID 4052 wrote to memory of 1992	4052	Consignment Details.exe	75
PID 3028 wrote to memory of 3432	3028	Explorer.EXE	77
PID 3028 wrote to memory of 3432	3028	Explorer.EXE	77
PID 3028 wrote to memory of 3432	3028	Explorer.EXE	77
PID 3432 wrote to memory of 4040	3432	msdt.exe	81
PID 3432 wrote to memory of 4040	3432	msdt.exe	81
PID 3432 wrote to memory of 4040	3432	msdt.exe	81

memory/1992-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3432-7-0x0000000000C70000-0x0000000000DE3000-memory.dmp

Download

memory/3432-8-0x0000000000C70000-0x0000000000DE3000-memory.dmp

Download

memory/3432-10-0x0000000006810000-0x0000000006976000-memory.dmp

Download