formbook | 43822089dc4bbbe3800a980d2ac64435c0b00dd18648c0fd56dda65b11af5a35

General

Target

spptqzbEyNlEJvj.exe
Size

801KB
MD5

fac6e34cc6144304a2a4c9f59ad426cb
SHA1

c28d46950f2f4f163fca3fb042d33ab23a7c81e1
SHA256

43822089dc4bbbe3800a980d2ac64435c0b00dd18648c0fd56dda65b11af5a35
SHA512

3fbc3a9e6d707468d53cf5e0244b5e4c58a85e822605a4cd71b127620736a90d23915a5ba5eaaed825cd55da61e64b7efde7a2c8e6dd6909fa17acff1eb78ccc

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.asicprominer.com/umSa/

Decoy

lessensations.com

growcerybank.com

rvworkforce.com

djangosports.com

jgrosinger.com

tongjiash.com

rianebrady.com

xiaoxu.info

allwaysautism.com

couturev.com

dantedikhali.com

sagamoreca.com

sandisyardsale.com

happizi.com

moonchildboxco.store

maquillajembp.com

sojubythebay.com

verdexwellness.com

authenticperiod.cloud

bitpreserve.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1532-2-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1532-3-0x000000000041D060-mapping.dmp	xloader
behavioral1/memory/1676-4-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

464 cmd.exe

pid	process
464	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

spptqzbEyNlEJvj.exespptqzbEyNlEJvj.execmmon32.exe

description	pid	process	target process
PID 644 set thread context of 1532	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 1532 set thread context of 1200	1532	spptqzbEyNlEJvj.exe	Explorer.EXE
PID 1532 set thread context of 1200	1532	spptqzbEyNlEJvj.exe	Explorer.EXE
PID 1676 set thread context of 1200	1676	cmmon32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

spptqzbEyNlEJvj.exespptqzbEyNlEJvj.execmmon32.exe

pid	process
644	spptqzbEyNlEJvj.exe
1532	spptqzbEyNlEJvj.exe
1532	spptqzbEyNlEJvj.exe
1532	spptqzbEyNlEJvj.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe
1676	cmmon32.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

spptqzbEyNlEJvj.execmmon32.exe

pid process

1532 spptqzbEyNlEJvj.exe
1532 spptqzbEyNlEJvj.exe
1532 spptqzbEyNlEJvj.exe
1532 spptqzbEyNlEJvj.exe
1676 cmmon32.exe
1676 cmmon32.exe

pid	process
1532	spptqzbEyNlEJvj.exe
1532	spptqzbEyNlEJvj.exe
1532	spptqzbEyNlEJvj.exe
1532	spptqzbEyNlEJvj.exe
1676	cmmon32.exe
1676	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

spptqzbEyNlEJvj.exespptqzbEyNlEJvj.execmmon32.exe

description	pid	process
Token: SeDebugPrivilege	644	spptqzbEyNlEJvj.exe
Token: SeDebugPrivilege	1532	spptqzbEyNlEJvj.exe
Token: SeDebugPrivilege	1676	cmmon32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

spptqzbEyNlEJvj.exeExplorer.EXEcmmon32.exe

description	pid	process	target process
PID 644 wrote to memory of 836	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 836	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 836	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 836	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 1532	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 1532	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 1532	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 1532	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 1532	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 1532	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 644 wrote to memory of 1532	644	spptqzbEyNlEJvj.exe	spptqzbEyNlEJvj.exe
PID 1200 wrote to memory of 1676	1200	Explorer.EXE	cmmon32.exe
PID 1200 wrote to memory of 1676	1200	Explorer.EXE	cmmon32.exe
PID 1200 wrote to memory of 1676	1200	Explorer.EXE	cmmon32.exe
PID 1200 wrote to memory of 1676	1200	Explorer.EXE	cmmon32.exe
PID 1676 wrote to memory of 464	1676	cmmon32.exe	cmd.exe
PID 1676 wrote to memory of 464	1676	cmmon32.exe	cmd.exe
PID 1676 wrote to memory of 464	1676	cmmon32.exe	cmd.exe
PID 1676 wrote to memory of 464	1676	cmmon32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\spptqzbEyNlEJvj.exe
  "C:\Users\Admin\AppData\Local\Temp\spptqzbEyNlEJvj.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Users\Admin\AppData\Local\Temp\spptqzbEyNlEJvj.exe
    "C:\Users\Admin\AppData\Local\Temp\spptqzbEyNlEJvj.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\spptqzbEyNlEJvj.exe
    "C:\Users\Admin\AppData\Local\Temp\spptqzbEyNlEJvj.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\spptqzbEyNlEJvj.exe"
    3⤵
    - Deletes itself
    PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/464-6-0x0000000000000000-mapping.dmp

Download
memory/1532-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1532-3-0x000000000041D060-mapping.dmp

Download
memory/1676-4-0x0000000000000000-mapping.dmp

Download
memory/1676-5-0x0000000000DF0000-0x0000000000DFD000-memory.dmp

Filesize
52KB

Download
memory/1676-7-0x00000000041D0000-0x0000000004339000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads