formbook | 034a88044cda55e5e899dda57067450bb725109dcfc9147d6ae41d7b08584734

General

Target

LOWE COPY.exe
Size

952KB
MD5

22f9f9ee353bd2cb4fa8402de52626c2
SHA1

8ce8dc75f001d54a622844034d4159268c4bf994
SHA256

034a88044cda55e5e899dda57067450bb725109dcfc9147d6ae41d7b08584734
SHA512

5b29c736ed127800283526cb0538059da973d930d174bd344b0cd5a80e68cbbc586252a88f3e52e115eb9ad757dc734b6c068734e68b024d1487541e60e1e27c

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.a-emeservice.com/m8ec/

Decoy

thomascraigwealth.com

melbournemedicalhealth.net

tdxcoin.com

lukassbprojects.net

aldemallc.com

moqawalat-kuwait.com

txcsco.com

jobcarepro.com

sedotwcmedanmurah.com

niconthenine.com

radliffrehab.com

infiniteechogroup.com

stellantis-luxury-rent.com

ibusehat.info

resellerauctions.com

softwarexprogrammers.com

bumpnlifestyle.com

mintmacher.com

partapprintercare.com

justrightinsurance.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1080-8-0x000000000041D0A0-mapping.dmp	xloader
behavioral1/memory/1080-7-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/392-10-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

280 cmd.exe

pid	process
280	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

LOWE COPY.exeLOWE COPY.execolorcpl.exe

description	pid	process	target process
PID 1944 set thread context of 1080	1944	LOWE COPY.exe	LOWE COPY.exe
PID 1080 set thread context of 1236	1080	LOWE COPY.exe	Explorer.EXE
PID 1080 set thread context of 1236	1080	LOWE COPY.exe	Explorer.EXE
PID 392 set thread context of 1236	392	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

LOWE COPY.execolorcpl.exe

pid	process
1080	LOWE COPY.exe
1080	LOWE COPY.exe
1080	LOWE COPY.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe
392	colorcpl.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

LOWE COPY.execolorcpl.exe

pid process

1080 LOWE COPY.exe
1080 LOWE COPY.exe
1080 LOWE COPY.exe
1080 LOWE COPY.exe
392 colorcpl.exe
392 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

LOWE COPY.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 1080 LOWE COPY.exe
Token: SeDebugPrivilege 392 colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	1080	LOWE COPY.exe
Token: SeDebugPrivilege	392	colorcpl.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

LOWE COPY.exeLOWE COPY.execolorcpl.exe

description	pid	process	target process
PID 1944 wrote to memory of 1080	1944	LOWE COPY.exe	LOWE COPY.exe
PID 1944 wrote to memory of 1080	1944	LOWE COPY.exe	LOWE COPY.exe
PID 1944 wrote to memory of 1080	1944	LOWE COPY.exe	LOWE COPY.exe
PID 1944 wrote to memory of 1080	1944	LOWE COPY.exe	LOWE COPY.exe
PID 1944 wrote to memory of 1080	1944	LOWE COPY.exe	LOWE COPY.exe
PID 1944 wrote to memory of 1080	1944	LOWE COPY.exe	LOWE COPY.exe
PID 1944 wrote to memory of 1080	1944	LOWE COPY.exe	LOWE COPY.exe
PID 1080 wrote to memory of 392	1080	LOWE COPY.exe	colorcpl.exe
PID 1080 wrote to memory of 392	1080	LOWE COPY.exe	colorcpl.exe
PID 1080 wrote to memory of 392	1080	LOWE COPY.exe	colorcpl.exe
PID 1080 wrote to memory of 392	1080	LOWE COPY.exe	colorcpl.exe
PID 392 wrote to memory of 280	392	colorcpl.exe	cmd.exe
PID 392 wrote to memory of 280	392	colorcpl.exe	cmd.exe
PID 392 wrote to memory of 280	392	colorcpl.exe	cmd.exe
PID 392 wrote to memory of 280	392	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\LOWE COPY.exe
"C:\Users\Admin\AppData\Local\Temp\LOWE COPY.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\LOWE COPY.exe
"C:\Users\Admin\AppData\Local\Temp\LOWE COPY.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\LOWE COPY.exe"
5⤵
- Deletes itself
PID:280

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/280-12-0x0000000000000000-mapping.dmp

Download
memory/392-10-0x0000000000000000-mapping.dmp

Download
memory/392-11-0x0000000000360000-0x0000000000378000-memory.dmp

Filesize
96KB

Download
memory/392-13-0x0000000004400000-0x0000000004555000-memory.dmp

Filesize
1.3MB

Download
memory/1080-8-0x000000000041D0A0-mapping.dmp

Download
memory/1080-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1236-9-0x0000000006570000-0x0000000006680000-memory.dmp

Filesize
1.1MB

Download
memory/1944-2-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/1944-3-0x0000000001150000-0x0000000001151000-memory.dmp

Filesize
4KB

Download
memory/1944-5-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/1944-6-0x0000000005500000-0x0000000005561000-memory.dmp

Filesize
388KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads