formbook | 574e414e22746d7781bd6ca6f4cc64be417b65696104dda71b037c9584cea01f

General

Target
SKM_C3350191107102300.exe
Size 349KB
Sample201216-h396vtmf9x
SHA256 574e414e22746d7781bd6ca6f4cc64be417b65696104dda71b037c9584cea01f
MD5 6f5d2b42f4a74886ac3284fa9a414a87
SHA1 c843fa55b16548ff0378194993e873a0b1b31a31
SHA512 098c318b5d87bb02ccf462f45e1eac3834a238be1363d53b3222d83fada64bddd5de3a3a8705bb1b6beea2fb269dac8cc7faacc79df6f412e7e7bf3997c0d328
MD5 SHA1 SHA512

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.4mzn-l1mit.com/x2ee/

Decoy

imarrawk.com
focusonyouwa.com
thedallygrind.com
hexa4shop.com
rebeccaroni.com
rocketmortgageliar.net
roomkoala.com
zewkr.com
gighomesale.com
xenonsunglasses.com
clqck.com
alittlereward.com
neuroeka.digital
gadgetsat.online
steigersteel.com
fsjdc.com
realnie-svingeri.site
directcare.pro
mo-kita.com
faxbbs.com
magenx2.info
alrihabexpress.com
mandarinorientalcondosboca.com
submitahero.com
bloglifeme.com
31camillestreet.com
christinemchughic.com
dingtaifeng.ltd
sculpturepaintingvietnam.com
maga-tramontina.com
hotelmeriya.com
genumkm-pertamina.com
vihaanmoorthy.com
putramandiricyber.com
gzlydt.com
ahlussunnahfortaleza.com
suksuk.net
matilier.com
housepopup.com
pro-traffic.group
gentsclubdubai.com
saideheng.com
artsfam.com
garimaproperties.com
waf.design
ugcfashion.com
sieuthiansach.com
herbcraze420.com
ninetydollarwebsites.com
sutiabodybeauty.com
wy113l.com
myenterprisedesk.com
theskinnyspritz.com
datasoma.digital
wefixpclaptop.com
kathleendenese.com
thehuntingandfishingshow.com
puequefun.com
markenvandrerhjem.com
greenvillehorticulturellc.com
annmargaretkeller.com
treasurespoint.com
chegemblocsbattle.com
biciesentieri.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2032-5-0x000000000041D010-mapping.dmp	xloader
behavioral1/memory/2032-3-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1748-8-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

pid	Process
848	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 784 set thread context of 2032	784	SKM_C3350191107102300.exe	28
PID 2032 set thread context of 1268	2032	SKM_C3350191107102300.exe	11
PID 1748 set thread context of 1268	1748	cmd.exe	11

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2032	SKM_C3350191107102300.exe
2032	SKM_C3350191107102300.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe
1748	cmd.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
784	SKM_C3350191107102300.exe
2032	SKM_C3350191107102300.exe
2032	SKM_C3350191107102300.exe
2032	SKM_C3350191107102300.exe
1748	cmd.exe
1748	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	SKM_C3350191107102300.exe
Token: SeDebugPrivilege	1748	cmd.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1528	784	SKM_C3350191107102300.exe	27
PID 784 wrote to memory of 1528	784	SKM_C3350191107102300.exe	27
PID 784 wrote to memory of 1528	784	SKM_C3350191107102300.exe	27
PID 784 wrote to memory of 1528	784	SKM_C3350191107102300.exe	27
PID 784 wrote to memory of 2032	784	SKM_C3350191107102300.exe	28
PID 784 wrote to memory of 2032	784	SKM_C3350191107102300.exe	28
PID 784 wrote to memory of 2032	784	SKM_C3350191107102300.exe	28
PID 784 wrote to memory of 2032	784	SKM_C3350191107102300.exe	28
PID 784 wrote to memory of 2032	784	SKM_C3350191107102300.exe	28
PID 1528 wrote to memory of 1980	1528	cmd.exe	29
PID 1528 wrote to memory of 1980	1528	cmd.exe	29
PID 1528 wrote to memory of 1980	1528	cmd.exe	29
PID 1528 wrote to memory of 1980	1528	cmd.exe	29
PID 1268 wrote to memory of 1748	1268	Explorer.EXE	30
PID 1268 wrote to memory of 1748	1268	Explorer.EXE	30
PID 1268 wrote to memory of 1748	1268	Explorer.EXE	30
PID 1268 wrote to memory of 1748	1268	Explorer.EXE	30
PID 1748 wrote to memory of 848	1748	cmd.exe	34
PID 1748 wrote to memory of 848	1748	cmd.exe	34
PID 1748 wrote to memory of 848	1748	cmd.exe	34
PID 1748 wrote to memory of 848	1748	cmd.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe
  "C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1f5539868fdb4da9bb066ca38b887f0a.xml"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1f5539868fdb4da9bb066ca38b887f0a.xml"
      4⤵
      Creates scheduled task(s)
      PID:1980
- - C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe
    "C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"
    3⤵
    - Deletes itself
    PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-12-0x0000000007310000-0x0000000007494000-memory.dmp

Download

memory/1748-9-0x000000004AC00000-0x000000004AC4C000-memory.dmp

Download

memory/1748-11-0x0000000004200000-0x00000000042A8000-memory.dmp

Download

memory/2032-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads