formbook | e4e84d03d4cb709d737f9ee3e69b40d797e452d83faa35f0a06bb78a87ad0984

General

Target

16e1a5d26c0698ac48d63661264e0ba1.exe
Size

639KB
MD5

16e1a5d26c0698ac48d63661264e0ba1
SHA1

5e61d05157c4aa1acfc6a89de619f6bbcad176f6
SHA256

e4e84d03d4cb709d737f9ee3e69b40d797e452d83faa35f0a06bb78a87ad0984
SHA512

2b2e106e5bb198bfa88469a7c4b7b72c93e0c91e8037128033df25075c02855f9c0b4e97748cc9fb317c32ad19e3930e4274cf806ed7b7aea377734adb4d9d4e

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1240-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1240-12-0x000000000041D070-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

16e1a5d26c0698ac48d63661264e0ba1.exe

description pid process target process

PID 648 set thread context of 1240 648 16e1a5d26c0698ac48d63661264e0ba1.exe 16e1a5d26c0698ac48d63661264e0ba1.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

16e1a5d26c0698ac48d63661264e0ba1.exe

pid process

1240 16e1a5d26c0698ac48d63661264e0ba1.exe
1240 16e1a5d26c0698ac48d63661264e0ba1.exe

description	pid	process	target process
PID 648 set thread context of 1240	648	16e1a5d26c0698ac48d63661264e0ba1.exe	16e1a5d26c0698ac48d63661264e0ba1.exe

pid	process
1240	16e1a5d26c0698ac48d63661264e0ba1.exe
1240	16e1a5d26c0698ac48d63661264e0ba1.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

16e1a5d26c0698ac48d63661264e0ba1.exe

description	pid	process	target process
PID 648 wrote to memory of 1240	648	16e1a5d26c0698ac48d63661264e0ba1.exe	16e1a5d26c0698ac48d63661264e0ba1.exe
PID 648 wrote to memory of 1240	648	16e1a5d26c0698ac48d63661264e0ba1.exe	16e1a5d26c0698ac48d63661264e0ba1.exe
PID 648 wrote to memory of 1240	648	16e1a5d26c0698ac48d63661264e0ba1.exe	16e1a5d26c0698ac48d63661264e0ba1.exe
PID 648 wrote to memory of 1240	648	16e1a5d26c0698ac48d63661264e0ba1.exe	16e1a5d26c0698ac48d63661264e0ba1.exe
PID 648 wrote to memory of 1240	648	16e1a5d26c0698ac48d63661264e0ba1.exe	16e1a5d26c0698ac48d63661264e0ba1.exe
PID 648 wrote to memory of 1240	648	16e1a5d26c0698ac48d63661264e0ba1.exe	16e1a5d26c0698ac48d63661264e0ba1.exe

C:\Users\Admin\AppData\Local\Temp\16e1a5d26c0698ac48d63661264e0ba1.exe
"C:\Users\Admin\AppData\Local\Temp\16e1a5d26c0698ac48d63661264e0ba1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\16e1a5d26c0698ac48d63661264e0ba1.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/648-3-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/648-5-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/648-6-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download
memory/648-7-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/648-8-0x00000000054B0000-0x00000000054BE000-memory.dmp

Filesize
56KB

Download
memory/648-9-0x0000000006290000-0x0000000006309000-memory.dmp

Filesize
484KB

Download
memory/648-10-0x00000000063B0000-0x00000000063B1000-memory.dmp

Filesize
4KB

Download
memory/1240-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1240-12-0x000000000041D070-mapping.dmp

Download

Analysis

Sharing