formbook | 7052f92dce4eaee0a7a7046c6529d6ebc79ddb2ee6e487cf34c6c7cd5dfea6ee

General

Target
5c46bfec3ed39ea08feb47002eb83b38.exe
Size 637KB
Sample201215-x3ndtlxdae
SHA256 7052f92dce4eaee0a7a7046c6529d6ebc79ddb2ee6e487cf34c6c7cd5dfea6ee
MD5 5c46bfec3ed39ea08feb47002eb83b38
SHA1 340e0f16322bc4b0d49bed3900398eaac65d1590
SHA512 6b89463aaca430019f832dc6437619337b146ac79f67011b39f35a882904b3613bce0aa95ae836663f14a1f9fc3bc2daf82ea707f4b25c7ee5d8830ccf8b3179
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1028-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1028-13-0x000000000041D0C0-mapping.dmp	xloader

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5c46bfec3ed39ea08feb47002eb83b38.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5c46bfec3ed39ea08feb47002eb83b38.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	5c46bfec3ed39ea08feb47002eb83b38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	5c46bfec3ed39ea08feb47002eb83b38.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 1028	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	32

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1028	5c46bfec3ed39ea08feb47002eb83b38.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 792	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	30
PID 1204 wrote to memory of 792	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	30
PID 1204 wrote to memory of 792	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	30
PID 1204 wrote to memory of 792	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	30
PID 1204 wrote to memory of 1028	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	32
PID 1204 wrote to memory of 1028	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	32
PID 1204 wrote to memory of 1028	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	32
PID 1204 wrote to memory of 1028	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	32
PID 1204 wrote to memory of 1028	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	32
PID 1204 wrote to memory of 1028	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	32
PID 1204 wrote to memory of 1028	1204	5c46bfec3ed39ea08feb47002eb83b38.exe	32

C:\Users\Admin\AppData\Local\Temp\5c46bfec3ed39ea08feb47002eb83b38.exe
"C:\Users\Admin\AppData\Local\Temp\5c46bfec3ed39ea08feb47002eb83b38.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hHkVkkIPjJF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD24.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:792
- C:\Users\Admin\AppData\Local\Temp\5c46bfec3ed39ea08feb47002eb83b38.exe
  "C:\Users\Admin\AppData\Local\Temp\5c46bfec3ed39ea08feb47002eb83b38.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028