formbook | c826a0b0506ddc4d93aba9f41ed795a88cca8bdb8c54f4af5d8dbdf9767e9ad3

General

Target

quotation.exe
Size

480KB
MD5

b8b31b2dfb196bcb986dddf77bd5c7d9
SHA1

ff124d255fdd65fb6bc7071af8126557e777975a
SHA256

c826a0b0506ddc4d93aba9f41ed795a88cca8bdb8c54f4af5d8dbdf9767e9ad3
SHA512

7eda7d2dc17ceef9a4fd1a0c6c9e9634e861bab4919312230733e5c2772d09de9a25ce43397de018614bc7e48ce416d56e7dfdbc7307b36da9d7ffe8c4e0b9ab

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.4mzn-l1mit.com/x2ee/

Decoy

imarrawk.com

focusonyouwa.com

thedallygrind.com

hexa4shop.com

rebeccaroni.com

rocketmortgageliar.net

roomkoala.com

zewkr.com

gighomesale.com

xenonsunglasses.com

clqck.com

alittlereward.com

neuroeka.digital

gadgetsat.online

steigersteel.com

fsjdc.com

realnie-svingeri.site

directcare.pro

mo-kita.com

faxbbs.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/776-3-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/776-4-0x000000000041D010-mapping.dmp	xloader
behavioral1/memory/1796-7-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1568 cmd.exe

pid	process
1568	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

quotation.exequotation.exesvchost.exe

description	pid	process	target process
PID 1676 set thread context of 776	1676	quotation.exe	quotation.exe
PID 776 set thread context of 1248	776	quotation.exe	Explorer.EXE
PID 1796 set thread context of 1248	1796	svchost.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1740 schtasks.exe

pid	process
1740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

quotation.exesvchost.exe

pid	process
776	quotation.exe
776	quotation.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe
1796	svchost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

quotation.exequotation.exesvchost.exe

pid process

1676 quotation.exe
776 quotation.exe
776 quotation.exe
776 quotation.exe
1796 svchost.exe
1796 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

quotation.exesvchost.exe

description pid process

Token: SeDebugPrivilege 776 quotation.exe
Token: SeDebugPrivilege 1796 svchost.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE

pid	process
1676	quotation.exe
776	quotation.exe
776	quotation.exe
776	quotation.exe
1796	svchost.exe
1796	svchost.exe

description	pid	process
Token: SeDebugPrivilege	776	quotation.exe
Token: SeDebugPrivilege	1796	svchost.exe

pid	process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

pid	process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

quotation.execmd.exeExplorer.EXEsvchost.exe

description	pid	process	target process
PID 1676 wrote to memory of 580	1676	quotation.exe	cmd.exe
PID 1676 wrote to memory of 580	1676	quotation.exe	cmd.exe
PID 1676 wrote to memory of 580	1676	quotation.exe	cmd.exe
PID 1676 wrote to memory of 580	1676	quotation.exe	cmd.exe
PID 1676 wrote to memory of 776	1676	quotation.exe	quotation.exe
PID 1676 wrote to memory of 776	1676	quotation.exe	quotation.exe
PID 1676 wrote to memory of 776	1676	quotation.exe	quotation.exe
PID 1676 wrote to memory of 776	1676	quotation.exe	quotation.exe
PID 1676 wrote to memory of 776	1676	quotation.exe	quotation.exe
PID 580 wrote to memory of 1740	580	cmd.exe	schtasks.exe
PID 580 wrote to memory of 1740	580	cmd.exe	schtasks.exe
PID 580 wrote to memory of 1740	580	cmd.exe	schtasks.exe
PID 580 wrote to memory of 1740	580	cmd.exe	schtasks.exe
PID 1248 wrote to memory of 1796	1248	Explorer.EXE	svchost.exe
PID 1248 wrote to memory of 1796	1248	Explorer.EXE	svchost.exe
PID 1248 wrote to memory of 1796	1248	Explorer.EXE	svchost.exe
PID 1248 wrote to memory of 1796	1248	Explorer.EXE	svchost.exe
PID 1796 wrote to memory of 1568	1796	svchost.exe	cmd.exe
PID 1796 wrote to memory of 1568	1796	svchost.exe	cmd.exe
PID 1796 wrote to memory of 1568	1796	svchost.exe	cmd.exe
PID 1796 wrote to memory of 1568	1796	svchost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\quotation.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\17d691995f9d4f47a2b74bcdcd0e85fe.xml"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:580
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\17d691995f9d4f47a2b74bcdcd0e85fe.xml"
      4⤵
      Creates scheduled task(s)
      PID:1740
- - C:\Users\Admin\AppData\Local\Temp\quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\quotation.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\quotation.exe"
    3⤵
    - Deletes itself
    PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\17d691995f9d4f47a2b74bcdcd0e85fe.xml

MD5
9313352a59e3b368ab4eb8173567c406

SHA1
fc776c28e3ae9bd5e68f25c2a4f6248126731370

SHA256
469d4994320f37196faca4de8ada85161a43dd42c9405b283bea5e4ea84c9a8d

SHA512
000f6edf387b4ea0f244003fad3f66be5eb1920012838ba3a19c3f2dcde973fce8450c8e556c22cc20f7a3a0980d735fb169ecfafd440993c9fe5b8875fc7462

Download Submit
memory/580-2-0x0000000000000000-mapping.dmp

Download
memory/776-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/776-4-0x000000000041D010-mapping.dmp

Download
memory/1568-9-0x0000000000000000-mapping.dmp

Download
memory/1740-5-0x0000000000000000-mapping.dmp

Download
memory/1796-7-0x0000000000000000-mapping.dmp

Download
memory/1796-8-0x00000000000D0000-0x00000000000D8000-memory.dmp

Filesize
32KB

Download
memory/1796-10-0x0000000004140000-0x0000000004234000-memory.dmp

Filesize
976KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads