formbook | 4abfdb9315d534afdc9907bcf369d15a121e02d40dc772dece65de6ee2ade651

General

Target

file2.exe
Size

699KB
MD5

4aac66abd3deb77faf44d3fb5884f0a6
SHA1

a5b550d6b41ad1cd9287d2892a65ac856de1bebf
SHA256

4abfdb9315d534afdc9907bcf369d15a121e02d40dc772dece65de6ee2ade651
SHA512

3be81a77ffadb309689738dec4e6f235eff195492e21451d373113e531b3f516b9db2b43857577fd9257a6014934124e26bd84a80683fe3eca6666b69fe398f1

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.herbmedia.net/csv8/

Decoy

slgacha.com

oohdough.com

6983ylc.com

aykassociate.com

latin-hotspot.com

starrockindia.com

beamsubway.com

queensboutique1000.com

madbaddie.com

bhoomimart.com

ankitparivar.com

aldanasanchezmx.com

citest1597669833.com

cristianofreitas.com

myplantus.com

counterfeitmilk.com

8xf39.com

pregnantwomens.com

yyyut6.com

stnanguo.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1980-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1980-14-0x000000000041D0C0-mapping.dmp	xloader
behavioral2/memory/2092-15-0x0000000000000000-mapping.dmp	xloader

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 3 IoCs

Processes:

file2.exevbc.execolorcpl.exe

description	pid	process	target process
PID 640 set thread context of 1980	640	file2.exe	vbc.exe
PID 1980 set thread context of 3028	1980	vbc.exe	Explorer.EXE
PID 2092 set thread context of 3028	2092	colorcpl.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1308 schtasks.exe

pid	process
1308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

Processes:

file2.exevbc.execolorcpl.exe

pid	process
640	file2.exe
1980	vbc.exe
1980	vbc.exe
1980	vbc.exe
1980	vbc.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe
2092	colorcpl.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

vbc.execolorcpl.exe

pid process

1980 vbc.exe
1980 vbc.exe
1980 vbc.exe
2092 colorcpl.exe
2092 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

file2.exevbc.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 640 file2.exe
Token: SeDebugPrivilege 1980 vbc.exe
Token: SeDebugPrivilege 2092 colorcpl.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3028 Explorer.EXE

pid	process
1980	vbc.exe
1980	vbc.exe
1980	vbc.exe
2092	colorcpl.exe
2092	colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	640	file2.exe
Token: SeDebugPrivilege	1980	vbc.exe
Token: SeDebugPrivilege	2092	colorcpl.exe

pid	process
3028	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

file2.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 640 wrote to memory of 1308	640	file2.exe	schtasks.exe
PID 640 wrote to memory of 1308	640	file2.exe	schtasks.exe
PID 640 wrote to memory of 1308	640	file2.exe	schtasks.exe
PID 640 wrote to memory of 1980	640	file2.exe	vbc.exe
PID 640 wrote to memory of 1980	640	file2.exe	vbc.exe
PID 640 wrote to memory of 1980	640	file2.exe	vbc.exe
PID 640 wrote to memory of 1980	640	file2.exe	vbc.exe
PID 640 wrote to memory of 1980	640	file2.exe	vbc.exe
PID 640 wrote to memory of 1980	640	file2.exe	vbc.exe
PID 3028 wrote to memory of 2092	3028	Explorer.EXE	colorcpl.exe
PID 3028 wrote to memory of 2092	3028	Explorer.EXE	colorcpl.exe
PID 3028 wrote to memory of 2092	3028	Explorer.EXE	colorcpl.exe
PID 2092 wrote to memory of 804	2092	colorcpl.exe	cmd.exe
PID 2092 wrote to memory of 804	2092	colorcpl.exe	cmd.exe
PID 2092 wrote to memory of 804	2092	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\file2.exe
"C:\Users\Admin\AppData\Local\Temp\file2.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emozgtRJhjspJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64A.tmp"
3⤵
- Creates scheduled task(s)
PID:1308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp64A.tmp
MD5
4a3561a42db97d9b700dc1c57391ec52

SHA1
7bdb8d695e543022eb2e37758b1b45a42b2fe476

SHA256
335c8397372e39a9f3d2956fa564146ffcf9489b9e908097adba12fb15a8fc0c

SHA512
7aa47d45d2d2fcdeeda322554951feb54a1cf05af464f6729f95f0e94742fcb05d515ef738bf305253d0b1a7c61344132c658dd01e418b8c7546c9af4d19c5ed

Download Submit
memory/640-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/640-5-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

Filesize
4KB

Download
memory/640-6-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/640-7-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/640-8-0x00000000057B0000-0x00000000057BE000-memory.dmp

Filesize
56KB

Download
memory/640-9-0x0000000007C60000-0x0000000007CDB000-memory.dmp

Filesize
492KB

Download
memory/640-10-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/640-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/804-18-0x0000000000000000-mapping.dmp

Download
memory/1308-11-0x0000000000000000-mapping.dmp

Download
memory/1980-14-0x000000000041D0C0-mapping.dmp

Download
memory/1980-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2092-15-0x0000000000000000-mapping.dmp

Download
memory/2092-16-0x0000000000F80000-0x0000000000F99000-memory.dmp

Filesize
100KB

Download
memory/2092-17-0x0000000000F80000-0x0000000000F99000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads