formbook | 148007b32a311769a958c3f87c6c836b14457f17dbe6a9a0188b0f68b3c30b40

General

Target

Consignment Details.exe
Size

328KB
MD5

911e2991f8d0899edbba11364e064350
SHA1

e58ecc5eb7388aed5b4d59ad3d5e317bcc44769b
SHA256

148007b32a311769a958c3f87c6c836b14457f17dbe6a9a0188b0f68b3c30b40
SHA512

f56aea41dc7d89472d60e21f90cbf261fcddf34b59790b0953e5d57b7e5d1668ea23f9e7f6336256bfef2ad0d9f187eec3776806eb94d1c7efc17de8dd375f86

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.elevatedenterprizes.com/h3qo/

Decoy

dhflow.com

jyindex.com

ezcleanhandle.com

trungtamcongdong.online

simsprotectionagency.com

easylivemeet.com

blackvikingfashionhouse.com

52banxue.com

girlsinit.com

drhemo.com

freethefarmers.com

velvetrosephotography.com

geometricbotaniclas.com

skyandspirit.com

deltacomunicacao.com

mucademy.com

jaboilfieldsolutions.net

howtowinatblackjacknow.com

anytimegrowth.com

simranluthra.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3560-2-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3560-3-0x000000000041D0E0-mapping.dmp	xloader
behavioral2/memory/2040-5-0x0000000000000000-mapping.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

Consignment Details.exeConsignment Details.exehelp.exe

description	pid	process	target process
PID 1048 set thread context of 3560	1048	Consignment Details.exe	Consignment Details.exe
PID 3560 set thread context of 3012	3560	Consignment Details.exe	Explorer.EXE
PID 2040 set thread context of 3012	2040	help.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

Consignment Details.exehelp.exe

pid	process
3560	Consignment Details.exe
3560	Consignment Details.exe
3560	Consignment Details.exe
3560	Consignment Details.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe
2040	help.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Consignment Details.exeConsignment Details.exehelp.exe

pid process

1048 Consignment Details.exe
3560 Consignment Details.exe
3560 Consignment Details.exe
3560 Consignment Details.exe
2040 help.exe
2040 help.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Consignment Details.exehelp.exe

description pid process

Token: SeDebugPrivilege 3560 Consignment Details.exe
Token: SeDebugPrivilege 2040 help.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3012 Explorer.EXE

pid	process
1048	Consignment Details.exe
3560	Consignment Details.exe
3560	Consignment Details.exe
3560	Consignment Details.exe
2040	help.exe
2040	help.exe

description	pid	process
Token: SeDebugPrivilege	3560	Consignment Details.exe
Token: SeDebugPrivilege	2040	help.exe

pid	process
3012	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Consignment Details.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 1048 wrote to memory of 3560	1048	Consignment Details.exe	Consignment Details.exe
PID 1048 wrote to memory of 3560	1048	Consignment Details.exe	Consignment Details.exe
PID 1048 wrote to memory of 3560	1048	Consignment Details.exe	Consignment Details.exe
PID 1048 wrote to memory of 3560	1048	Consignment Details.exe	Consignment Details.exe
PID 3012 wrote to memory of 2040	3012	Explorer.EXE	help.exe
PID 3012 wrote to memory of 2040	3012	Explorer.EXE	help.exe
PID 3012 wrote to memory of 2040	3012	Explorer.EXE	help.exe
PID 2040 wrote to memory of 2308	2040	help.exe	cmd.exe
PID 2040 wrote to memory of 2308	2040	help.exe	cmd.exe
PID 2040 wrote to memory of 2308	2040	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3012

C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"
3⤵
PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-5-0x0000000000000000-mapping.dmp

Download
memory/2040-6-0x00000000012C0000-0x00000000012C7000-memory.dmp

Filesize
28KB

Download
memory/2040-7-0x00000000012C0000-0x00000000012C7000-memory.dmp

Filesize
28KB

Download
memory/2308-8-0x0000000000000000-mapping.dmp

Download
memory/3560-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3560-3-0x000000000041D0E0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads