formbook | 92463d5500d27c6270248dfa01e99a77cc33c5caab3ae357c424b3d42864a4f7

General

Target

6blnUJRr4yKrjCS.exe
Size

845KB
MD5

8bde4f2dbbb7abf5f54c799ecab14a27
SHA1

82923df0764bc80d4e8dc2dc1b53c92417d042d6
SHA256

92463d5500d27c6270248dfa01e99a77cc33c5caab3ae357c424b3d42864a4f7
SHA512

29476254d6223819a3cde1bc3100318d66736d106e8376671fa9e225d46b4e934aba2bc2871bcf83ce6c30d3a27e2085fc787752ef5f4870dcf14b551d902773

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.asicprominer.com/umSa/

Decoy

lessensations.com

growcerybank.com

rvworkforce.com

djangosports.com

jgrosinger.com

tongjiash.com

rianebrady.com

xiaoxu.info

allwaysautism.com

couturev.com

dantedikhali.com

sagamoreca.com

sandisyardsale.com

happizi.com

moonchildboxco.store

maquillajembp.com

sojubythebay.com

verdexwellness.com

authenticperiod.cloud

bitpreserve.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/752-2-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/752-3-0x000000000041D060-mapping.dmp	xloader
behavioral1/memory/432-4-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1552 cmd.exe

pid	process
1552	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

6blnUJRr4yKrjCS.exe6blnUJRr4yKrjCS.exechkdsk.exe

description	pid	process	target process
PID 1924 set thread context of 752	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 752 set thread context of 1276	752	6blnUJRr4yKrjCS.exe	Explorer.EXE
PID 432 set thread context of 1276	432	chkdsk.exe	Explorer.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

6blnUJRr4yKrjCS.exe6blnUJRr4yKrjCS.exechkdsk.exe

pid	process
1924	6blnUJRr4yKrjCS.exe
1924	6blnUJRr4yKrjCS.exe
752	6blnUJRr4yKrjCS.exe
752	6blnUJRr4yKrjCS.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe
432	chkdsk.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

6blnUJRr4yKrjCS.exechkdsk.exe

pid process

752 6blnUJRr4yKrjCS.exe
752 6blnUJRr4yKrjCS.exe
752 6blnUJRr4yKrjCS.exe
432 chkdsk.exe
432 chkdsk.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

6blnUJRr4yKrjCS.exe6blnUJRr4yKrjCS.exechkdsk.exe

description pid process

Token: SeDebugPrivilege 1924 6blnUJRr4yKrjCS.exe
Token: SeDebugPrivilege 752 6blnUJRr4yKrjCS.exe
Token: SeDebugPrivilege 432 chkdsk.exe

pid	process
752	6blnUJRr4yKrjCS.exe
752	6blnUJRr4yKrjCS.exe
752	6blnUJRr4yKrjCS.exe
432	chkdsk.exe
432	chkdsk.exe

description	pid	process
Token: SeDebugPrivilege	1924	6blnUJRr4yKrjCS.exe
Token: SeDebugPrivilege	752	6blnUJRr4yKrjCS.exe
Token: SeDebugPrivilege	432	chkdsk.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

6blnUJRr4yKrjCS.exeExplorer.EXEchkdsk.exe

description	pid	process	target process
PID 1924 wrote to memory of 340	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 340	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 340	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 340	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 752	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 752	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 752	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 752	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 752	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 752	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1924 wrote to memory of 752	1924	6blnUJRr4yKrjCS.exe	6blnUJRr4yKrjCS.exe
PID 1276 wrote to memory of 432	1276	Explorer.EXE	chkdsk.exe
PID 1276 wrote to memory of 432	1276	Explorer.EXE	chkdsk.exe
PID 1276 wrote to memory of 432	1276	Explorer.EXE	chkdsk.exe
PID 1276 wrote to memory of 432	1276	Explorer.EXE	chkdsk.exe
PID 432 wrote to memory of 1552	432	chkdsk.exe	cmd.exe
PID 432 wrote to memory of 1552	432	chkdsk.exe	cmd.exe
PID 432 wrote to memory of 1552	432	chkdsk.exe	cmd.exe
PID 432 wrote to memory of 1552	432	chkdsk.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\6blnUJRr4yKrjCS.exe
"C:\Users\Admin\AppData\Local\Temp\6blnUJRr4yKrjCS.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Local\Temp\6blnUJRr4yKrjCS.exe
"C:\Users\Admin\AppData\Local\Temp\6blnUJRr4yKrjCS.exe"
3⤵
PID:340

C:\Users\Admin\AppData\Local\Temp\6blnUJRr4yKrjCS.exe
"C:\Users\Admin\AppData\Local\Temp\6blnUJRr4yKrjCS.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\6blnUJRr4yKrjCS.exe"
3⤵
- Deletes itself
PID:1552

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-4-0x0000000000000000-mapping.dmp

Download
memory/432-5-0x0000000000B10000-0x0000000000B17000-memory.dmp

Filesize
28KB

Download
memory/432-7-0x0000000004320000-0x000000000444C000-memory.dmp

Filesize
1.2MB

Download
memory/752-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/752-3-0x000000000041D060-mapping.dmp

Download
memory/1552-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads