formbook | a21da47756a5b8a820ac633dcc6902b2ca4b9dd0861741f8f68153e5c436bda5

Analysis

max time kernel
35s
max time network
104s
platform
windows10_x64
resource
win10v20201028
submitted
12-01-2021 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f322138c86416ce5503ff3c49cb4f01.exe
Size

731KB
MD5

4f322138c86416ce5503ff3c49cb4f01
SHA1

87ccb2e2cf10e5beab77711ef2ddc025430e3151
SHA256

a21da47756a5b8a820ac633dcc6902b2ca4b9dd0861741f8f68153e5c436bda5
SHA512

a8292e75388ac981899e8256901bfca625d35d5ff96539e19fa10db6729fb536f26f6cbac8f82c3ef5b1a257273826c6d00e10827acda41c8d38bf3c0245fbe8

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

http://www.classifoods.com/oean/

Decoy

keboate.club

whitehatiq.com

loimtech.com

icaroagencia.com

snigglez.com

noreservationsxpress.com

villacascabel.com

5037adairway.com

growingequity.fund

stafffully.com

bingent.info

tmssaleguarantee.com

neonatalfeedrates.com

george-beauty.com

oraghallaighjourney.net

zunutrition.com

sylkysmooveentertainment.com

ddmns6tzey2d.com

dvcstay.com

304shaughnessygreen.info

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4320-3-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/4320-4-0x000000000041CFE0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

4f322138c86416ce5503ff3c49cb4f01.exe

description pid process target process

PID 4776 set thread context of 4320 4776 4f322138c86416ce5503ff3c49cb4f01.exe 4f322138c86416ce5503ff3c49cb4f01.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4f322138c86416ce5503ff3c49cb4f01.exe

pid process

4320 4f322138c86416ce5503ff3c49cb4f01.exe
4320 4f322138c86416ce5503ff3c49cb4f01.exe

description	pid	process	target process
PID 4776 set thread context of 4320	4776	4f322138c86416ce5503ff3c49cb4f01.exe	4f322138c86416ce5503ff3c49cb4f01.exe

pid	process
4320	4f322138c86416ce5503ff3c49cb4f01.exe
4320	4f322138c86416ce5503ff3c49cb4f01.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4f322138c86416ce5503ff3c49cb4f01.exe

description	pid	process	target process
PID 4776 wrote to memory of 4320	4776	4f322138c86416ce5503ff3c49cb4f01.exe	4f322138c86416ce5503ff3c49cb4f01.exe
PID 4776 wrote to memory of 4320	4776	4f322138c86416ce5503ff3c49cb4f01.exe	4f322138c86416ce5503ff3c49cb4f01.exe
PID 4776 wrote to memory of 4320	4776	4f322138c86416ce5503ff3c49cb4f01.exe	4f322138c86416ce5503ff3c49cb4f01.exe
PID 4776 wrote to memory of 4320	4776	4f322138c86416ce5503ff3c49cb4f01.exe	4f322138c86416ce5503ff3c49cb4f01.exe
PID 4776 wrote to memory of 4320	4776	4f322138c86416ce5503ff3c49cb4f01.exe	4f322138c86416ce5503ff3c49cb4f01.exe
PID 4776 wrote to memory of 4320	4776	4f322138c86416ce5503ff3c49cb4f01.exe	4f322138c86416ce5503ff3c49cb4f01.exe

C:\Users\Admin\AppData\Local\Temp\4f322138c86416ce5503ff3c49cb4f01.exe
"C:\Users\Admin\AppData\Local\Temp\4f322138c86416ce5503ff3c49cb4f01.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776

C:\Users\Admin\AppData\Local\Temp\4f322138c86416ce5503ff3c49cb4f01.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4320-4-0x000000000041CFE0-mapping.dmp

Download
memory/4776-2-0x0000000073150000-0x000000007383E000-memory.dmp

Filesize
6.9MB

Download