formbook | dca4c9a7846a3ebb066c08583388adeb4b05e464f20abd10409ccf47164d8635

General

Target

1358ae1fa6701b06f8f168c359cb62d6.exe
Size

837KB
MD5

1358ae1fa6701b06f8f168c359cb62d6
SHA1

a611886f3335a0be5bd83226833d67e9cddf5b6b
SHA256

dca4c9a7846a3ebb066c08583388adeb4b05e464f20abd10409ccf47164d8635
SHA512

a5738a23bbe3187afe2040b7aa59da430641684c8476213845ff235efd419ba82eb0ea9b4f1c592130338a20a90c2a23043f56e727415bb22a1281e87b813634

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.classifoods.com/oean/

Decoy

keboate.club

whitehatiq.com

loimtech.com

icaroagencia.com

snigglez.com

noreservationsxpress.com

villacascabel.com

5037adairway.com

growingequity.fund

stafffully.com

bingent.info

tmssaleguarantee.com

neonatalfeedrates.com

george-beauty.com

oraghallaighjourney.net

zunutrition.com

sylkysmooveentertainment.com

ddmns6tzey2d.com

dvcstay.com

304shaughnessygreen.info

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1656-7-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1656-8-0x000000000041CFE0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

1358ae1fa6701b06f8f168c359cb62d6.exe

description pid process target process

PID 784 set thread context of 1656 784 1358ae1fa6701b06f8f168c359cb62d6.exe 1358ae1fa6701b06f8f168c359cb62d6.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1358ae1fa6701b06f8f168c359cb62d6.exe

pid process

1656 1358ae1fa6701b06f8f168c359cb62d6.exe

description	pid	process	target process
PID 784 set thread context of 1656	784	1358ae1fa6701b06f8f168c359cb62d6.exe	1358ae1fa6701b06f8f168c359cb62d6.exe

pid	process
1656	1358ae1fa6701b06f8f168c359cb62d6.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

1358ae1fa6701b06f8f168c359cb62d6.exe

description	pid	process	target process
PID 784 wrote to memory of 1656	784	1358ae1fa6701b06f8f168c359cb62d6.exe	1358ae1fa6701b06f8f168c359cb62d6.exe
PID 784 wrote to memory of 1656	784	1358ae1fa6701b06f8f168c359cb62d6.exe	1358ae1fa6701b06f8f168c359cb62d6.exe
PID 784 wrote to memory of 1656	784	1358ae1fa6701b06f8f168c359cb62d6.exe	1358ae1fa6701b06f8f168c359cb62d6.exe
PID 784 wrote to memory of 1656	784	1358ae1fa6701b06f8f168c359cb62d6.exe	1358ae1fa6701b06f8f168c359cb62d6.exe
PID 784 wrote to memory of 1656	784	1358ae1fa6701b06f8f168c359cb62d6.exe	1358ae1fa6701b06f8f168c359cb62d6.exe
PID 784 wrote to memory of 1656	784	1358ae1fa6701b06f8f168c359cb62d6.exe	1358ae1fa6701b06f8f168c359cb62d6.exe
PID 784 wrote to memory of 1656	784	1358ae1fa6701b06f8f168c359cb62d6.exe	1358ae1fa6701b06f8f168c359cb62d6.exe

C:\Users\Admin\AppData\Local\Temp\1358ae1fa6701b06f8f168c359cb62d6.exe
"C:\Users\Admin\AppData\Local\Temp\1358ae1fa6701b06f8f168c359cb62d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\1358ae1fa6701b06f8f168c359cb62d6.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/784-3-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/784-5-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/784-6-0x00000000056E0000-0x0000000005773000-memory.dmp

Filesize
588KB

Download
memory/1656-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1656-8-0x000000000041CFE0-mapping.dmp

Download

Analysis

Sharing