formbook | 5cd75052c82b5ff0cc1261075c4fdb060c21062c72525508cbb75e44683f6d0b

General

Target

Draft FCR-HBL.exe
Size

642KB
MD5

cca5f563da874fee695fd34f35d9692a
SHA1

727fb4e81e190f36516432e2d3e07c22e7534ca5
SHA256

5cd75052c82b5ff0cc1261075c4fdb060c21062c72525508cbb75e44683f6d0b
SHA512

7ae58590d4540eac9cda384adb1d7fb206d4c9086cdfd5797a3add87eb60025f92824ed63ceeda578303adde0f247ca701f3904762eacda5cd9d99c22811c5f6

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.basketballcardgame.com/mmfg/

Decoy

sweetlifeandstyle.com

testhomesteaddomain.com

findersforce.com

tmobitvmall.com

wishganmet.info

shimizuvps.com

onfirecreativegroup.com

jeremyroywilliams.com

utopiabangkok.com

caiwweizipper.com

kvartira.credit

shreesakthifoods.com

redirmsg.com

ellopooch.com

casinossurveillancenetwork.com

taskso.com

aaoficial.life

jointwellscap.com

katecorc.com

talkbirds.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1384-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1384-12-0x000000000041D100-mapping.dmp	xloader
behavioral2/memory/980-14-0x0000000000000000-mapping.dmp	xloader

Suspicious use of SetThreadContext 4 IoCs

Processes:

Draft FCR-HBL.exeDraft FCR-HBL.exenetsh.exe

description	pid	process	target process
PID 1316 set thread context of 1384	1316	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1384 set thread context of 2352	1384	Draft FCR-HBL.exe	Explorer.EXE
PID 1384 set thread context of 2352	1384	Draft FCR-HBL.exe	Explorer.EXE
PID 980 set thread context of 2352	980	netsh.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

Draft FCR-HBL.exenetsh.exe

pid	process
1384	Draft FCR-HBL.exe
1384	Draft FCR-HBL.exe
1384	Draft FCR-HBL.exe
1384	Draft FCR-HBL.exe
1384	Draft FCR-HBL.exe
1384	Draft FCR-HBL.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe
980	netsh.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Draft FCR-HBL.exenetsh.exe

pid process

1384 Draft FCR-HBL.exe
1384 Draft FCR-HBL.exe
1384 Draft FCR-HBL.exe
1384 Draft FCR-HBL.exe
980 netsh.exe
980 netsh.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Draft FCR-HBL.exenetsh.exe

description pid process

Token: SeDebugPrivilege 1384 Draft FCR-HBL.exe
Token: SeDebugPrivilege 980 netsh.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2352 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1384	Draft FCR-HBL.exe
Token: SeDebugPrivilege	980	netsh.exe

pid	process
2352	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Draft FCR-HBL.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 1316 wrote to memory of 1384	1316	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1316 wrote to memory of 1384	1316	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1316 wrote to memory of 1384	1316	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1316 wrote to memory of 1384	1316	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1316 wrote to memory of 1384	1316	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 1316 wrote to memory of 1384	1316	Draft FCR-HBL.exe	Draft FCR-HBL.exe
PID 2352 wrote to memory of 980	2352	Explorer.EXE	netsh.exe
PID 2352 wrote to memory of 980	2352	Explorer.EXE	netsh.exe
PID 2352 wrote to memory of 980	2352	Explorer.EXE	netsh.exe
PID 980 wrote to memory of 500	980	netsh.exe	cmd.exe
PID 980 wrote to memory of 500	980	netsh.exe	cmd.exe
PID 980 wrote to memory of 500	980	netsh.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2352

C:\Users\Admin\AppData\Local\Temp\Draft FCR-HBL.exe
"C:\Users\Admin\AppData\Local\Temp\Draft FCR-HBL.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Local\Temp\Draft FCR-HBL.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Draft FCR-HBL.exe"
3⤵
PID:500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-17-0x0000000000000000-mapping.dmp

Download
memory/980-14-0x0000000000000000-mapping.dmp

Download
memory/980-18-0x0000000005720000-0x00000000058A3000-memory.dmp

Filesize
1.5MB

Download
memory/980-16-0x0000000000980000-0x000000000099E000-memory.dmp

Filesize
120KB

Download
memory/980-15-0x0000000000980000-0x000000000099E000-memory.dmp

Filesize
120KB

Download
memory/1316-9-0x0000000007C40000-0x0000000007CCC000-memory.dmp

Filesize
560KB

Download
memory/1316-2-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/1316-10-0x0000000007D70000-0x0000000007D71000-memory.dmp

Filesize
4KB

Download
memory/1316-8-0x00000000057D0000-0x00000000057DE000-memory.dmp

Filesize
56KB

Download
memory/1316-7-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/1316-6-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/1316-5-0x0000000005D00000-0x0000000005D01000-memory.dmp

Filesize
4KB

Download
memory/1316-3-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/1384-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-12-0x000000000041D100-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads