formbook | 444e72d12e85dffc1b247b29e7789022b251237f56ea83bf72e3c09fcb628874

General

Target

Consignment Document PL&BL Draft.exe
Size

318KB
MD5

ef20635d931f69c41175aa8f1d81d60c
SHA1

3e00db6de337ef48f82ed1af80ca998ea86c5601
SHA256

444e72d12e85dffc1b247b29e7789022b251237f56ea83bf72e3c09fcb628874
SHA512

d9131029f0dbf8f59fa761031f0962c75dbbf138a97344e242434b324110fda7b7e9507b93bbd2224f5bd5cc654e7accce1e9994ddad499e386086d93ded5f13

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.elevatedenterprizes.com/h3qo/

Decoy

dhflow.com

jyindex.com

ezcleanhandle.com

trungtamcongdong.online

simsprotectionagency.com

easylivemeet.com

blackvikingfashionhouse.com

52banxue.com

girlsinit.com

drhemo.com

freethefarmers.com

velvetrosephotography.com

geometricbotaniclas.com

skyandspirit.com

deltacomunicacao.com

mucademy.com

jaboilfieldsolutions.net

howtowinatblackjacknow.com

anytimegrowth.com

simranluthra.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1736-2-0x00000000000B0000-0x00000000000D9000-memory.dmp	xloader
behavioral1/memory/1736-3-0x00000000000CD0E0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

Consignment Document PL&BL Draft.exe

description pid process target process

PID 1732 set thread context of 1736 1732 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 1736 WerFault.exe Consignment Document PL&BL Draft.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1740 WerFault.exe
1740 WerFault.exe
1740 WerFault.exe
1740 WerFault.exe
1740 WerFault.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Consignment Document PL&BL Draft.exe

pid process

1732 Consignment Document PL&BL Draft.exe
1732 Consignment Document PL&BL Draft.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1740 WerFault.exe

description	pid	process	target process
PID 1732 set thread context of 1736	1732	Consignment Document PL&BL Draft.exe	Consignment Document PL&BL Draft.exe

pid	pid_target	process	target process
1740	1736	WerFault.exe	Consignment Document PL&BL Draft.exe

pid	process
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe

pid	process
1732	Consignment Document PL&BL Draft.exe
1732	Consignment Document PL&BL Draft.exe

description	pid	process
Token: SeDebugPrivilege	1740	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Consignment Document PL&BL Draft.exeConsignment Document PL&BL Draft.exe

description	pid	process	target process
PID 1732 wrote to memory of 1736	1732	Consignment Document PL&BL Draft.exe	Consignment Document PL&BL Draft.exe
PID 1732 wrote to memory of 1736	1732	Consignment Document PL&BL Draft.exe	Consignment Document PL&BL Draft.exe
PID 1732 wrote to memory of 1736	1732	Consignment Document PL&BL Draft.exe	Consignment Document PL&BL Draft.exe
PID 1732 wrote to memory of 1736	1732	Consignment Document PL&BL Draft.exe	Consignment Document PL&BL Draft.exe
PID 1732 wrote to memory of 1736	1732	Consignment Document PL&BL Draft.exe	Consignment Document PL&BL Draft.exe
PID 1736 wrote to memory of 1740	1736	Consignment Document PL&BL Draft.exe	WerFault.exe
PID 1736 wrote to memory of 1740	1736	Consignment Document PL&BL Draft.exe	WerFault.exe
PID 1736 wrote to memory of 1740	1736	Consignment Document PL&BL Draft.exe	WerFault.exe
PID 1736 wrote to memory of 1740	1736	Consignment Document PL&BL Draft.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 36
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-2-0x00000000000B0000-0x00000000000D9000-memory.dmp

Filesize
164KB

Download
memory/1736-3-0x00000000000CD0E0-mapping.dmp

Download
memory/1740-5-0x0000000000000000-mapping.dmp

Download
memory/1740-6-0x0000000001FC0000-0x0000000001FD1000-memory.dmp

Filesize
68KB

Download
memory/1740-7-0x00000000024B0000-0x00000000024C1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing