formbook | 373978ea9f4ae282536f4991ffac268b5597b69c399633ca9e2f97b8dbd01c6f

General

Target

38301c250d764f40143b6a88d999de1a.exe
Size

909KB
MD5

38301c250d764f40143b6a88d999de1a
SHA1

fdc439f83852aefcd6bf4063ca98e7ab9551d5aa
SHA256

373978ea9f4ae282536f4991ffac268b5597b69c399633ca9e2f97b8dbd01c6f
SHA512

7e9d1e9fb9b726e6e96f38e779fc4260ca742bc5c54936a84fc93cfa6e93ab4d89fc37ad9b8307246aef163336e5be81dc158da7fe0318c30633d867ee228a1e

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/752-7-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/752-8-0x000000000041D070-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

38301c250d764f40143b6a88d999de1a.exe

description pid process target process

PID 1080 set thread context of 752 1080 38301c250d764f40143b6a88d999de1a.exe 38301c250d764f40143b6a88d999de1a.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

38301c250d764f40143b6a88d999de1a.exe

pid process

752 38301c250d764f40143b6a88d999de1a.exe

description	pid	process	target process
PID 1080 set thread context of 752	1080	38301c250d764f40143b6a88d999de1a.exe	38301c250d764f40143b6a88d999de1a.exe

pid	process
752	38301c250d764f40143b6a88d999de1a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

38301c250d764f40143b6a88d999de1a.exe

description	pid	process	target process
PID 1080 wrote to memory of 752	1080	38301c250d764f40143b6a88d999de1a.exe	38301c250d764f40143b6a88d999de1a.exe
PID 1080 wrote to memory of 752	1080	38301c250d764f40143b6a88d999de1a.exe	38301c250d764f40143b6a88d999de1a.exe
PID 1080 wrote to memory of 752	1080	38301c250d764f40143b6a88d999de1a.exe	38301c250d764f40143b6a88d999de1a.exe
PID 1080 wrote to memory of 752	1080	38301c250d764f40143b6a88d999de1a.exe	38301c250d764f40143b6a88d999de1a.exe
PID 1080 wrote to memory of 752	1080	38301c250d764f40143b6a88d999de1a.exe	38301c250d764f40143b6a88d999de1a.exe
PID 1080 wrote to memory of 752	1080	38301c250d764f40143b6a88d999de1a.exe	38301c250d764f40143b6a88d999de1a.exe
PID 1080 wrote to memory of 752	1080	38301c250d764f40143b6a88d999de1a.exe	38301c250d764f40143b6a88d999de1a.exe

C:\Users\Admin\AppData\Local\Temp\38301c250d764f40143b6a88d999de1a.exe
"C:\Users\Admin\AppData\Local\Temp\38301c250d764f40143b6a88d999de1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080

C:\Users\Admin\AppData\Local\Temp\38301c250d764f40143b6a88d999de1a.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:752

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/752-8-0x000000000041D070-mapping.dmp

Download
memory/1080-2-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/1080-3-0x0000000001360000-0x0000000001361000-memory.dmp

Filesize
4KB

Download
memory/1080-5-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/1080-6-0x00000000057A0000-0x000000000582E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing