formbook | 5cd75052c82b5ff0cc1261075c4fdb060c21062c72525508cbb75e44683f6d0b

General

Target

Draft FCR-HBL.exe
Size

642KB
MD5

cca5f563da874fee695fd34f35d9692a
SHA1

727fb4e81e190f36516432e2d3e07c22e7534ca5
SHA256

5cd75052c82b5ff0cc1261075c4fdb060c21062c72525508cbb75e44683f6d0b
SHA512

7ae58590d4540eac9cda384adb1d7fb206d4c9086cdfd5797a3add87eb60025f92824ed63ceeda578303adde0f247ca701f3904762eacda5cd9d99c22811c5f6

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.basketballcardgame.com/mmfg/

Decoy

sweetlifeandstyle.com

testhomesteaddomain.com

findersforce.com

tmobitvmall.com

wishganmet.info

shimizuvps.com

onfirecreativegroup.com

jeremyroywilliams.com

utopiabangkok.com

caiwweizipper.com

kvartira.credit

shreesakthifoods.com

redirmsg.com

ellopooch.com

casinossurveillancenetwork.com

taskso.com

aaoficial.life

jointwellscap.com

katecorc.com

talkbirds.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1664-8-0x000000000041D100-mapping.dmp	xloader
behavioral1/memory/1664-7-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/268-9-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1052 cmd.exe

pid	process
1052	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Draft FCR-HBL.exeDraft FCR-HBL.execontrol.exe

description	pid	process	target process
PID 1068 set thread context of 1664	1068	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1664 set thread context of 1236	1664	Draft FCR-HBL.exe	Explorer.EXE
PID 268 set thread context of 1236	268	control.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

Draft FCR-HBL.execontrol.exe

pid	process
1664	Draft FCR-HBL.exe
1664	Draft FCR-HBL.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe
268	control.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Draft FCR-HBL.execontrol.exe

pid process

1664 Draft FCR-HBL.exe
1664 Draft FCR-HBL.exe
1664 Draft FCR-HBL.exe
268 control.exe
268 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Draft FCR-HBL.execontrol.exe

description pid process

Token: SeDebugPrivilege 1664 Draft FCR-HBL.exe
Token: SeDebugPrivilege 268 control.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1664	Draft FCR-HBL.exe
Token: SeDebugPrivilege	268	control.exe

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Draft FCR-HBL.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 1068 wrote to memory of 1664	1068	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1068 wrote to memory of 1664	1068	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1068 wrote to memory of 1664	1068	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1068 wrote to memory of 1664	1068	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1068 wrote to memory of 1664	1068	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1068 wrote to memory of 1664	1068	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1068 wrote to memory of 1664	1068	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1236 wrote to memory of 268	1236	Explorer.EXE	control.exe
PID 1236 wrote to memory of 268	1236	Explorer.EXE	control.exe
PID 1236 wrote to memory of 268	1236	Explorer.EXE	control.exe
PID 1236 wrote to memory of 268	1236	Explorer.EXE	control.exe
PID 268 wrote to memory of 1052	268	control.exe	cmd.exe
PID 268 wrote to memory of 1052	268	control.exe	cmd.exe
PID 268 wrote to memory of 1052	268	control.exe	cmd.exe
PID 268 wrote to memory of 1052	268	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\Draft FCR-HBL.exe
"C:\Users\Admin\AppData\Local\Temp\Draft FCR-HBL.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Local\Temp\Draft FCR-HBL.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Draft FCR-HBL.exe"
3⤵
- Deletes itself
PID:1052

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-9-0x0000000000000000-mapping.dmp

Download
memory/268-10-0x00000000001A0000-0x00000000001BF000-memory.dmp

Filesize
124KB

Download
memory/268-12-0x0000000004250000-0x00000000043BB000-memory.dmp

Filesize
1.4MB

Download
memory/1052-11-0x0000000000000000-mapping.dmp

Download
memory/1068-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1068-3-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1068-5-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download
memory/1068-6-0x00000000052B0000-0x000000000533C000-memory.dmp

Filesize
560KB

Download
memory/1664-8-0x000000000041D100-mapping.dmp

Download
memory/1664-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads