formbook | e49c51a6864bf50e27baca58c5a2420046cae1803c5e0338af152b50d0dcc215

General

Target

c1a46cb393041dbeb3aa1355d76232c7.exe
Size

1.0MB
MD5

c1a46cb393041dbeb3aa1355d76232c7
SHA1

f2573d8ae24aa2a4a24e6a3ed6170cdd29658211
SHA256

e49c51a6864bf50e27baca58c5a2420046cae1803c5e0338af152b50d0dcc215
SHA512

f6fe4d189141e7f0f867f1fdc55211c36ac810d290d84e8fa42b74e22a956e77b23f35f7c92040618c9e74028d197ca1045b033cfe15a099c5dcc22d92f7b076

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.classifoods.com/oean/

Decoy

keboate.club

whitehatiq.com

loimtech.com

icaroagencia.com

snigglez.com

noreservationsxpress.com

villacascabel.com

5037adairway.com

growingequity.fund

stafffully.com

bingent.info

tmssaleguarantee.com

neonatalfeedrates.com

george-beauty.com

oraghallaighjourney.net

zunutrition.com

sylkysmooveentertainment.com

ddmns6tzey2d.com

dvcstay.com

304shaughnessygreen.info

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/676-8-0x000000000041CFE0-mapping.dmp	xloader
behavioral1/memory/676-7-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

c1a46cb393041dbeb3aa1355d76232c7.exe

description pid process target process

PID 1824 set thread context of 676 1824 c1a46cb393041dbeb3aa1355d76232c7.exe c1a46cb393041dbeb3aa1355d76232c7.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c1a46cb393041dbeb3aa1355d76232c7.exe

pid process

676 c1a46cb393041dbeb3aa1355d76232c7.exe

description	pid	process	target process
PID 1824 set thread context of 676	1824	c1a46cb393041dbeb3aa1355d76232c7.exe	c1a46cb393041dbeb3aa1355d76232c7.exe

pid	process
676	c1a46cb393041dbeb3aa1355d76232c7.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c1a46cb393041dbeb3aa1355d76232c7.exe

description	pid	process	target process
PID 1824 wrote to memory of 676	1824	c1a46cb393041dbeb3aa1355d76232c7.exe	c1a46cb393041dbeb3aa1355d76232c7.exe
PID 1824 wrote to memory of 676	1824	c1a46cb393041dbeb3aa1355d76232c7.exe	c1a46cb393041dbeb3aa1355d76232c7.exe
PID 1824 wrote to memory of 676	1824	c1a46cb393041dbeb3aa1355d76232c7.exe	c1a46cb393041dbeb3aa1355d76232c7.exe
PID 1824 wrote to memory of 676	1824	c1a46cb393041dbeb3aa1355d76232c7.exe	c1a46cb393041dbeb3aa1355d76232c7.exe
PID 1824 wrote to memory of 676	1824	c1a46cb393041dbeb3aa1355d76232c7.exe	c1a46cb393041dbeb3aa1355d76232c7.exe
PID 1824 wrote to memory of 676	1824	c1a46cb393041dbeb3aa1355d76232c7.exe	c1a46cb393041dbeb3aa1355d76232c7.exe
PID 1824 wrote to memory of 676	1824	c1a46cb393041dbeb3aa1355d76232c7.exe	c1a46cb393041dbeb3aa1355d76232c7.exe

C:\Users\Admin\AppData\Local\Temp\c1a46cb393041dbeb3aa1355d76232c7.exe
"C:\Users\Admin\AppData\Local\Temp\c1a46cb393041dbeb3aa1355d76232c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Local\Temp\c1a46cb393041dbeb3aa1355d76232c7.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:676

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-8-0x000000000041CFE0-mapping.dmp

Download
memory/676-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1824-2-0x0000000073980000-0x000000007406E000-memory.dmp

Filesize
6.9MB

Download
memory/1824-3-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/1824-5-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/1824-6-0x0000000000520000-0x000000000059B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing