formbook | 180444e71cfbd639cea07e4cdc28099a444839f5ad3eb024b87dc9664fdfd5ec

General

Target
Doc_74657456348374.xlsx.exe
Size 731KB
Sample210112-df7h2yend2
SHA256 180444e71cfbd639cea07e4cdc28099a444839f5ad3eb024b87dc9664fdfd5ec
MD5 1e8f1e78b590bd90b327429d233c2fe9
SHA1 83eb02aa8a04deb275763d0ca93b130241d241a2
SHA512 fb6133a86040405c7063effed12866f9964ff3fe323726624806c3f718296de9fa9930235acb4ef28090fa2bc9c5194bc4f0bb9e0b29399f0ffc936c40025c55
MD5 SHA1 SHA512

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.mczx.net/hpg3/

Decoy

icheapwdshop.com
ilhemayad.com
visionaries-global.com
bondibootybuilder.com
largeprintonline.com
imoney.life
yin.finance
serrurier-depannage-lyon.com
bettar.xyz
robet89.com
sxqfuisju.icu
dveri-interior.com
propertyexpertsmiami.com
tawetap.com
agencykiller.pro
usableclassics.com
elocdigital.com
tronelite.com
aeshahcosmetics.com
comproticket.com
happyhours.life
wheelofmes.com
defendertools.com
strongfamilyfarms.com
telewaremail.com
antwerpdeclaration.info
henselectrlc.com
renownedafricanamericans.com
bodycandybyrose.com
benefitdiscovery.com
chintekec.com
libertyandgrit.com
iregentos.info
americamedsales.com
outsource-service.info
shirkhanigroup.com
kewangdz.com
nexus-ink.com
steak-shoyoju.com
dayinwhite.com
religionism-convection.com
nogginnaked.com
thesaffrongrp.com
canhelpcbd.com
fashionclothingonline.net
orcidstore.com
behome-garden.com
silentmoneyuk.com
takkibyhandan.com
mokkojikorea.net
realtyelitellc.com
everestgrup.xyz
unlikelypolitician.com
avito-rf.website
lovellengineering.com
bolzes.com
joyfulnose.com
storeathouse.com
julianasmithus.com
pawwild.com
mymakemoneyonlinefast.com
aaliyahchhabra.com
yyzacypzs.icu
bdxwines.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/400-9-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/400-10-0x000000000041D030-mapping.dmp	xloader
behavioral1/memory/1028-11-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

pid	Process
920	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 400	1204	Doc_74657456348374.xlsx.exe	31
PID 400 set thread context of 1264	400	Doc_74657456348374.xlsx.exe	12
PID 400 set thread context of 1264	400	Doc_74657456348374.xlsx.exe	12
PID 1028 set thread context of 1264	1028	systray.exe	12

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
400	Doc_74657456348374.xlsx.exe
400	Doc_74657456348374.xlsx.exe
400	Doc_74657456348374.xlsx.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe
1028	systray.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
400	Doc_74657456348374.xlsx.exe
400	Doc_74657456348374.xlsx.exe
400	Doc_74657456348374.xlsx.exe
400	Doc_74657456348374.xlsx.exe
1028	systray.exe
1028	systray.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	Doc_74657456348374.xlsx.exe
Token: SeDebugPrivilege	1028	systray.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1684	1204	Doc_74657456348374.xlsx.exe	29
PID 1204 wrote to memory of 1684	1204	Doc_74657456348374.xlsx.exe	29
PID 1204 wrote to memory of 1684	1204	Doc_74657456348374.xlsx.exe	29
PID 1204 wrote to memory of 1684	1204	Doc_74657456348374.xlsx.exe	29
PID 1204 wrote to memory of 400	1204	Doc_74657456348374.xlsx.exe	31
PID 1204 wrote to memory of 400	1204	Doc_74657456348374.xlsx.exe	31
PID 1204 wrote to memory of 400	1204	Doc_74657456348374.xlsx.exe	31
PID 1204 wrote to memory of 400	1204	Doc_74657456348374.xlsx.exe	31
PID 1204 wrote to memory of 400	1204	Doc_74657456348374.xlsx.exe	31
PID 1204 wrote to memory of 400	1204	Doc_74657456348374.xlsx.exe	31
PID 1204 wrote to memory of 400	1204	Doc_74657456348374.xlsx.exe	31
PID 1264 wrote to memory of 1028	1264	Explorer.EXE	32
PID 1264 wrote to memory of 1028	1264	Explorer.EXE	32
PID 1264 wrote to memory of 1028	1264	Explorer.EXE	32
PID 1264 wrote to memory of 1028	1264	Explorer.EXE	32
PID 1028 wrote to memory of 920	1028	systray.exe	33
PID 1028 wrote to memory of 920	1028	systray.exe	33
PID 1028 wrote to memory of 920	1028	systray.exe	33
PID 1028 wrote to memory of 920	1028	systray.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\Doc_74657456348374.xlsx.exe
  "C:\Users\Admin\AppData\Local\Temp\Doc_74657456348374.xlsx.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vGJzEtsAZlyR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB413.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Doc_74657456348374.xlsx.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Doc_74657456348374.xlsx.exe"
    3⤵
    - Deletes itself
    PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-9-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1028-12-0x0000000000FF0000-0x0000000000FF5000-memory.dmp

Download

memory/1028-14-0x0000000004160000-0x00000000042B8000-memory.dmp

Download

memory/1204-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/1204-3-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Download

memory/1204-5-0x0000000000840000-0x000000000084E000-memory.dmp

Download

memory/1204-6-0x0000000005730000-0x00000000057B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads