formbook | 148007b32a311769a958c3f87c6c836b14457f17dbe6a9a0188b0f68b3c30b40

General

Target

Consignment Details.exe
Size

328KB
MD5

911e2991f8d0899edbba11364e064350
SHA1

e58ecc5eb7388aed5b4d59ad3d5e317bcc44769b
SHA256

148007b32a311769a958c3f87c6c836b14457f17dbe6a9a0188b0f68b3c30b40
SHA512

f56aea41dc7d89472d60e21f90cbf261fcddf34b59790b0953e5d57b7e5d1668ea23f9e7f6336256bfef2ad0d9f187eec3776806eb94d1c7efc17de8dd375f86

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.elevatedenterprizes.com/h3qo/

Decoy

dhflow.com

jyindex.com

ezcleanhandle.com

trungtamcongdong.online

simsprotectionagency.com

easylivemeet.com

blackvikingfashionhouse.com

52banxue.com

girlsinit.com

drhemo.com

freethefarmers.com

velvetrosephotography.com

geometricbotaniclas.com

skyandspirit.com

deltacomunicacao.com

mucademy.com

jaboilfieldsolutions.net

howtowinatblackjacknow.com

anytimegrowth.com

simranluthra.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1176-2-0x0000000000070000-0x0000000000099000-memory.dmp	xloader
behavioral1/memory/1176-3-0x000000000008D0E0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

Consignment Details.exe

description pid process target process

PID 836 set thread context of 1176 836 Consignment Details.exe Consignment Details.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1984 1176 WerFault.exe Consignment Details.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1984 WerFault.exe
1984 WerFault.exe
1984 WerFault.exe
1984 WerFault.exe
1984 WerFault.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Consignment Details.exe

pid process

836 Consignment Details.exe
836 Consignment Details.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1984 WerFault.exe

description	pid	process	target process
PID 836 set thread context of 1176	836	Consignment Details.exe	Consignment Details.exe

pid	pid_target	process	target process
1984	1176	WerFault.exe	Consignment Details.exe

pid	process
1984	WerFault.exe
1984	WerFault.exe
1984	WerFault.exe
1984	WerFault.exe
1984	WerFault.exe

pid	process
836	Consignment Details.exe
836	Consignment Details.exe

description	pid	process
Token: SeDebugPrivilege	1984	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Consignment Details.exeConsignment Details.exe

description	pid	process	target process
PID 836 wrote to memory of 1176	836	Consignment Details.exe	Consignment Details.exe
PID 836 wrote to memory of 1176	836	Consignment Details.exe	Consignment Details.exe
PID 836 wrote to memory of 1176	836	Consignment Details.exe	Consignment Details.exe
PID 836 wrote to memory of 1176	836	Consignment Details.exe	Consignment Details.exe
PID 836 wrote to memory of 1176	836	Consignment Details.exe	Consignment Details.exe
PID 1176 wrote to memory of 1984	1176	Consignment Details.exe	WerFault.exe
PID 1176 wrote to memory of 1984	1176	Consignment Details.exe	WerFault.exe
PID 1176 wrote to memory of 1984	1176	Consignment Details.exe	WerFault.exe
PID 1176 wrote to memory of 1984	1176	Consignment Details.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe
  "C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 36
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-2-0x0000000000070000-0x0000000000099000-memory.dmp

Filesize
164KB

Download
memory/1176-3-0x000000000008D0E0-mapping.dmp

Download
memory/1984-5-0x0000000000000000-mapping.dmp

Download
memory/1984-6-0x0000000001F50000-0x0000000001F61000-memory.dmp

Filesize
68KB

Download
memory/1984-7-0x0000000002580000-0x0000000002591000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing