formbook | bcba31709cecf79a6996bda8b48a9e891db6de827c852404634a96d248560ba3

General

Target

Shipping Document PL&BL Draft.exe
Size

322KB
MD5

a0614d41b6280e3f8bce2015eb4ba7aa
SHA1

ffe5c224de394e76c0a971d56576efb36e68aff9
SHA256

bcba31709cecf79a6996bda8b48a9e891db6de827c852404634a96d248560ba3
SHA512

eeb581210b8a20b9d5629170ea53a0f7157daf875489707ab6c894cab84aa244b65efa28dd62d81512a61acf64e7aadd2cedc529c4fd42b32b09a37020b23377

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.elevatedenterprizes.com/h3qo/

Decoy

dhflow.com

jyindex.com

ezcleanhandle.com

trungtamcongdong.online

simsprotectionagency.com

easylivemeet.com

blackvikingfashionhouse.com

52banxue.com

girlsinit.com

drhemo.com

freethefarmers.com

velvetrosephotography.com

geometricbotaniclas.com

skyandspirit.com

deltacomunicacao.com

mucademy.com

jaboilfieldsolutions.net

howtowinatblackjacknow.com

anytimegrowth.com

simranluthra.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1976-3-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1976-4-0x000000000041D0E0-mapping.dmp	xloader
behavioral1/memory/824-7-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1284 cmd.exe

pid	process
1284	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Shipping Document PL&BL Draft.exeShipping Document PL&BL Draft.execolorcpl.exe

description	pid	process	target process
PID 1844 set thread context of 1976	1844	Shipping Document PL&BL Draft.exe	Shipping Document PL&BL Draft.exe
PID 1976 set thread context of 1236	1976	Shipping Document PL&BL Draft.exe	Explorer.EXE
PID 1976 set thread context of 1236	1976	Shipping Document PL&BL Draft.exe	Explorer.EXE
PID 824 set thread context of 1236	824	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Shipping Document PL&BL Draft.execolorcpl.exe

pid	process
1976	Shipping Document PL&BL Draft.exe
1976	Shipping Document PL&BL Draft.exe
1976	Shipping Document PL&BL Draft.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe
824	colorcpl.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Shipping Document PL&BL Draft.exeShipping Document PL&BL Draft.execolorcpl.exe

pid	process
1844	Shipping Document PL&BL Draft.exe
1976	Shipping Document PL&BL Draft.exe
1976	Shipping Document PL&BL Draft.exe
1976	Shipping Document PL&BL Draft.exe
1976	Shipping Document PL&BL Draft.exe
824	colorcpl.exe
824	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Shipping Document PL&BL Draft.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 1976 Shipping Document PL&BL Draft.exe
Token: SeDebugPrivilege 824 colorcpl.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1976	Shipping Document PL&BL Draft.exe
Token: SeDebugPrivilege	824	colorcpl.exe

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Shipping Document PL&BL Draft.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1844 wrote to memory of 1984	1844	Shipping Document PL&BL Draft.exe	cmd.exe
PID 1844 wrote to memory of 1984	1844	Shipping Document PL&BL Draft.exe	cmd.exe
PID 1844 wrote to memory of 1984	1844	Shipping Document PL&BL Draft.exe	cmd.exe
PID 1844 wrote to memory of 1984	1844	Shipping Document PL&BL Draft.exe	cmd.exe
PID 1844 wrote to memory of 1976	1844	Shipping Document PL&BL Draft.exe	Shipping Document PL&BL Draft.exe
PID 1844 wrote to memory of 1976	1844	Shipping Document PL&BL Draft.exe	Shipping Document PL&BL Draft.exe
PID 1844 wrote to memory of 1976	1844	Shipping Document PL&BL Draft.exe	Shipping Document PL&BL Draft.exe
PID 1844 wrote to memory of 1976	1844	Shipping Document PL&BL Draft.exe	Shipping Document PL&BL Draft.exe
PID 1844 wrote to memory of 1976	1844	Shipping Document PL&BL Draft.exe	Shipping Document PL&BL Draft.exe
PID 1236 wrote to memory of 824	1236	Explorer.EXE	colorcpl.exe
PID 1236 wrote to memory of 824	1236	Explorer.EXE	colorcpl.exe
PID 1236 wrote to memory of 824	1236	Explorer.EXE	colorcpl.exe
PID 1236 wrote to memory of 824	1236	Explorer.EXE	colorcpl.exe
PID 824 wrote to memory of 1284	824	colorcpl.exe	cmd.exe
PID 824 wrote to memory of 1284	824	colorcpl.exe	cmd.exe
PID 824 wrote to memory of 1284	824	colorcpl.exe	cmd.exe
PID 824 wrote to memory of 1284	824	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"
3⤵
- Deletes itself
PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-7-0x0000000000000000-mapping.dmp

Download
memory/824-8-0x0000000000040000-0x0000000000058000-memory.dmp

Filesize
96KB

Download
memory/824-10-0x0000000004310000-0x000000000448C000-memory.dmp

Filesize
1.5MB

Download
memory/1236-6-0x0000000003BD0000-0x0000000003CAB000-memory.dmp

Filesize
876KB

Download
memory/1284-9-0x0000000000000000-mapping.dmp

Download
memory/1976-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-4-0x000000000041D0E0-mapping.dmp

Download
memory/1984-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads