formbook | 985306a8b7a5cb0604af6bbbddea16f334b17bcec4c5477bdfdb0330ed66b674

General

Target

404e118191842e0697f2c29b98330d65.exe
Size

1.1MB
MD5

404e118191842e0697f2c29b98330d65
SHA1

07c0de4ad963fbd367b61fe5a1764d1242701ced
SHA256

985306a8b7a5cb0604af6bbbddea16f334b17bcec4c5477bdfdb0330ed66b674
SHA512

1da5f922d37f111f0be07556635068be757e3e164b502ab630f3ccfa4f3df48895decab0f95c1be7c2ebb3dc8bc68805af7765ca5f5b8fc986d1db93aa1e29f6

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.stonescapes1.com/de92/

Decoy

zindaginews.com

tyelevator.com

schustermaninterests.com

algemixdelchef.com

doubscollectivites.com

e-butchery.com

hellbentmask.com

jumbpprivacy.com

teeniestiedye.com

playfulartwork.com

desertvacahs.com

w5470-hed.net

nepalearningpods.com

smoothandsleek.com

thecannaglow.com

torrentkittyla.com

industrytoyou.com

raquelvargas.net

rlc-nc.net

cryptoprises.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1904-7-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1904-8-0x000000000041D010-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

404e118191842e0697f2c29b98330d65.exe

description pid process target process

PID 1068 set thread context of 1904 1068 404e118191842e0697f2c29b98330d65.exe 404e118191842e0697f2c29b98330d65.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

404e118191842e0697f2c29b98330d65.exe404e118191842e0697f2c29b98330d65.exe

pid process

1068 404e118191842e0697f2c29b98330d65.exe
1068 404e118191842e0697f2c29b98330d65.exe
1904 404e118191842e0697f2c29b98330d65.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

404e118191842e0697f2c29b98330d65.exe

description pid process

Token: SeDebugPrivilege 1068 404e118191842e0697f2c29b98330d65.exe

description	pid	process	target process
PID 1068 set thread context of 1904	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe

pid	process
1068	404e118191842e0697f2c29b98330d65.exe
1068	404e118191842e0697f2c29b98330d65.exe
1904	404e118191842e0697f2c29b98330d65.exe

description	pid	process
Token: SeDebugPrivilege	1068	404e118191842e0697f2c29b98330d65.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

404e118191842e0697f2c29b98330d65.exe

description	pid	process	target process
PID 1068 wrote to memory of 1080	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1080	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1080	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1080	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1904	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1904	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1904	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1904	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1904	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1904	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe
PID 1068 wrote to memory of 1904	1068	404e118191842e0697f2c29b98330d65.exe	404e118191842e0697f2c29b98330d65.exe

C:\Users\Admin\AppData\Local\Temp\404e118191842e0697f2c29b98330d65.exe
"C:\Users\Admin\AppData\Local\Temp\404e118191842e0697f2c29b98330d65.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Local\Temp\404e118191842e0697f2c29b98330d65.exe
"{path}"
2⤵
PID:1080

C:\Users\Admin\AppData\Local\Temp\404e118191842e0697f2c29b98330d65.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-2-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/1068-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1068-5-0x0000000000610000-0x000000000061E000-memory.dmp

Filesize
56KB

Download
memory/1068-6-0x00000000003C0000-0x0000000000443000-memory.dmp

Filesize
524KB

Download
memory/1904-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1904-8-0x000000000041D010-mapping.dmp

Download

Analysis

Sharing