formbook | ac23d4ba0e11c07488224b01abc734d353da88537ed55c945eec7a91a20216a4

General

Target

SKM_C3350191107102300.exe
Size

560KB
MD5

c5b91765063ed56b54eb8048711109bc
SHA1

4e62b1c4166d9f569a3d3dba845330e22cf4b23c
SHA256

ac23d4ba0e11c07488224b01abc734d353da88537ed55c945eec7a91a20216a4
SHA512

93a3746c89f36a2a3114d2d4e76525c9212f33d95725908ff991b828231e520f20ada1049d42ba8c3c0c2c8df2dfffb2c6837ea0a8382f740a55ca01dad2c0b6

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.4mzn-l1mit.com/x2ee/

Decoy

imarrawk.com

focusonyouwa.com

thedallygrind.com

hexa4shop.com

rebeccaroni.com

rocketmortgageliar.net

roomkoala.com

zewkr.com

gighomesale.com

xenonsunglasses.com

clqck.com

alittlereward.com

neuroeka.digital

gadgetsat.online

steigersteel.com

fsjdc.com

realnie-svingeri.site

directcare.pro

mo-kita.com

faxbbs.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2028-3-0x0000000000070000-0x0000000000098000-memory.dmp	xloader
behavioral1/memory/2028-4-0x000000000008D010-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

SKM_C3350191107102300.exe

description pid process target process

PID 1668 set thread context of 2028 1668 SKM_C3350191107102300.exe SKM_C3350191107102300.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 2028 WerFault.exe SKM_C3350191107102300.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1996 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1956 WerFault.exe
1956 WerFault.exe
1956 WerFault.exe
1956 WerFault.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

SKM_C3350191107102300.exe

pid process

1668 SKM_C3350191107102300.exe
1668 SKM_C3350191107102300.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1956 WerFault.exe

description	pid	process	target process
PID 1668 set thread context of 2028	1668	SKM_C3350191107102300.exe	SKM_C3350191107102300.exe

pid	pid_target	process	target process
1956	2028	WerFault.exe	SKM_C3350191107102300.exe

pid	process
1996	schtasks.exe

pid	process
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe

pid	process
1668	SKM_C3350191107102300.exe
1668	SKM_C3350191107102300.exe

description	pid	process
Token: SeDebugPrivilege	1956	WerFault.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

SKM_C3350191107102300.execmd.exeSKM_C3350191107102300.exe

description	pid	process	target process
PID 1668 wrote to memory of 1212	1668	SKM_C3350191107102300.exe	cmd.exe
PID 1668 wrote to memory of 1212	1668	SKM_C3350191107102300.exe	cmd.exe
PID 1668 wrote to memory of 1212	1668	SKM_C3350191107102300.exe	cmd.exe
PID 1668 wrote to memory of 1212	1668	SKM_C3350191107102300.exe	cmd.exe
PID 1668 wrote to memory of 2028	1668	SKM_C3350191107102300.exe	SKM_C3350191107102300.exe
PID 1668 wrote to memory of 2028	1668	SKM_C3350191107102300.exe	SKM_C3350191107102300.exe
PID 1668 wrote to memory of 2028	1668	SKM_C3350191107102300.exe	SKM_C3350191107102300.exe
PID 1668 wrote to memory of 2028	1668	SKM_C3350191107102300.exe	SKM_C3350191107102300.exe
PID 1668 wrote to memory of 2028	1668	SKM_C3350191107102300.exe	SKM_C3350191107102300.exe
PID 1212 wrote to memory of 1996	1212	cmd.exe	schtasks.exe
PID 1212 wrote to memory of 1996	1212	cmd.exe	schtasks.exe
PID 1212 wrote to memory of 1996	1212	cmd.exe	schtasks.exe
PID 1212 wrote to memory of 1996	1212	cmd.exe	schtasks.exe
PID 2028 wrote to memory of 1956	2028	SKM_C3350191107102300.exe	WerFault.exe
PID 2028 wrote to memory of 1956	2028	SKM_C3350191107102300.exe	WerFault.exe
PID 2028 wrote to memory of 1956	2028	SKM_C3350191107102300.exe	WerFault.exe
PID 2028 wrote to memory of 1956	2028	SKM_C3350191107102300.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe
"C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\c71863b966c54b048a6e888dca409982.xml"
2⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\c71863b966c54b048a6e888dca409982.xml"
3⤵
- Creates scheduled task(s)
PID:1996

C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe
"C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c71863b966c54b048a6e888dca409982.xml
MD5
9313352a59e3b368ab4eb8173567c406

SHA1
fc776c28e3ae9bd5e68f25c2a4f6248126731370

SHA256
469d4994320f37196faca4de8ada85161a43dd42c9405b283bea5e4ea84c9a8d

SHA512
000f6edf387b4ea0f244003fad3f66be5eb1920012838ba3a19c3f2dcde973fce8450c8e556c22cc20f7a3a0980d735fb169ecfafd440993c9fe5b8875fc7462

Download Submit
memory/1212-2-0x0000000000000000-mapping.dmp

Download
memory/1956-6-0x0000000000000000-mapping.dmp

Download
memory/1956-8-0x0000000001FA0000-0x0000000001FB1000-memory.dmp

Filesize
68KB

Download
memory/1956-9-0x0000000002580000-0x0000000002591000-memory.dmp

Filesize
68KB

Download
memory/1996-5-0x0000000000000000-mapping.dmp

Download
memory/2028-3-0x0000000000070000-0x0000000000098000-memory.dmp

Filesize
160KB

Download
memory/2028-4-0x000000000008D010-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads