formbook | e4141a1f1d7e56f4196a1cea4d0804d0206d858e452012fd36e5d1c0eac81c3d

General

Target

DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
Size

1.1MB
MD5

eb2002937cb72b457e35ce221ebf299e
SHA1

be5027e99c4f251652b533e768167ee5a40fc7e2
SHA256

e4141a1f1d7e56f4196a1cea4d0804d0206d858e452012fd36e5d1c0eac81c3d
SHA512

850e03147c2ea65119eff125dd4e6e5dc002721f22e3bcccacb1ad54661235a5244b86c2cc59e25737f81ba221a53411f025235376a22620373f4def8bc4e272

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.believe.academy/me2z/

Decoy

rampdauto.com

noriharte.com

harborfreightcreditcard.com

tktspyhwz.icu

cagehosting.com

hgfte.club

fullnessspa.com

link-repair.com

rrjyds.com

edevletdestekcardmerkez.com

sprayingmachines.com

janerowenlester.com

velocityworkflow.com

kcrm.computer

kjbubeng.com

virtualhockeyconference.com

trugrits.com

creativesociallight.com

dnaswabtesting.com

willpool.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1472-9-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1472-10-0x000000000041D090-mapping.dmp	xloader
behavioral1/memory/760-12-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1480 cmd.exe

pid	process
1480	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

DHL SHIPPING AND TRACKING DOCUMENT_PDF.exeDHL SHIPPING AND TRACKING DOCUMENT_PDF.exenetsh.exe

description	pid	process	target process
PID 1744 set thread context of 1472	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
PID 1472 set thread context of 1268	1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	Explorer.EXE
PID 1472 set thread context of 1268	1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	Explorer.EXE
PID 760 set thread context of 1268	760	netsh.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1080 schtasks.exe

pid	process
1080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

DHL SHIPPING AND TRACKING DOCUMENT_PDF.exenetsh.exe

pid	process
1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe
760	netsh.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

DHL SHIPPING AND TRACKING DOCUMENT_PDF.exenetsh.exe

pid	process
1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
760	netsh.exe
760	netsh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DHL SHIPPING AND TRACKING DOCUMENT_PDF.exenetsh.exe

description pid process

Token: SeDebugPrivilege 1472 DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
Token: SeDebugPrivilege 760 netsh.exe

description	pid	process
Token: SeDebugPrivilege	1472	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
Token: SeDebugPrivilege	760	netsh.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

DHL SHIPPING AND TRACKING DOCUMENT_PDF.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 1744 wrote to memory of 1080	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	schtasks.exe
PID 1744 wrote to memory of 1080	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	schtasks.exe
PID 1744 wrote to memory of 1080	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	schtasks.exe
PID 1744 wrote to memory of 1080	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	schtasks.exe
PID 1744 wrote to memory of 1472	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
PID 1744 wrote to memory of 1472	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
PID 1744 wrote to memory of 1472	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
PID 1744 wrote to memory of 1472	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
PID 1744 wrote to memory of 1472	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
PID 1744 wrote to memory of 1472	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
PID 1744 wrote to memory of 1472	1744	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe	DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
PID 1268 wrote to memory of 760	1268	Explorer.EXE	netsh.exe
PID 1268 wrote to memory of 760	1268	Explorer.EXE	netsh.exe
PID 1268 wrote to memory of 760	1268	Explorer.EXE	netsh.exe
PID 1268 wrote to memory of 760	1268	Explorer.EXE	netsh.exe
PID 760 wrote to memory of 1480	760	netsh.exe	cmd.exe
PID 760 wrote to memory of 1480	760	netsh.exe	cmd.exe
PID 760 wrote to memory of 1480	760	netsh.exe	cmd.exe
PID 760 wrote to memory of 1480	760	netsh.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ndyNgiAFxyaGRA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF90E.tmp"
3⤵
- Creates scheduled task(s)
PID:1080

C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING AND TRACKING DOCUMENT_PDF.exe"
3⤵
- Deletes itself
PID:1480

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF90E.tmp
MD5
3dcd026944d9020781af6e07a8ca0896

SHA1
b8c2aa842787beaa0f13f7900e9179c9c70bfdbf

SHA256
7e432db90d54ac2567166dc038ee7bc2815883d688f7a5ef1d873aa66b88f353

SHA512
4eace6907785f8a51642849dd0b692a679a7cd2a8ad4589d3c2be3c3b54c750fe2f3e063a6f1848a13ef0037267b0c9f790bce7b414163cfc3dffa9f2bb10f3d

Download Submit
memory/760-15-0x00000000053F0000-0x000000000552D000-memory.dmp

Filesize
1.2MB

Download
memory/760-13-0x00000000009A0000-0x00000000009BB000-memory.dmp

Filesize
108KB

Download
memory/760-12-0x0000000000000000-mapping.dmp

Download
memory/1080-7-0x0000000000000000-mapping.dmp

Download
memory/1268-11-0x0000000005F70000-0x0000000006063000-memory.dmp

Filesize
972KB

Download
memory/1472-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1472-10-0x000000000041D090-mapping.dmp

Download
memory/1480-14-0x0000000000000000-mapping.dmp

Download
memory/1744-2-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/1744-6-0x00000000051A0000-0x0000000005208000-memory.dmp

Filesize
416KB

Download
memory/1744-5-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/1744-3-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads