formbook | 5b895b1fe7b66a92588a06eba17a83022da0b539dd9c2eaafbf6082a656f7b57

General

Target

Invoice_20210115122010.scr
Size

295KB
MD5

ca4bbc7aa2c2cd0bf193b1fe0bbd2d49
SHA1

dd82900ef5f0023ebee0c44a7fd0d8bdfea6f635
SHA256

5b895b1fe7b66a92588a06eba17a83022da0b539dd9c2eaafbf6082a656f7b57
SHA512

0968a8deed84c3d6b7b8a77ade86582f67fc276450268414d695c17d7eb78f091e18107185fbb0f3bc269f928aa8763903c5fa37ece68af4863869b63ef040cd

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.elevatedenterprizes.com/h3qo/

Decoy

dhflow.com

jyindex.com

ezcleanhandle.com

trungtamcongdong.online

simsprotectionagency.com

easylivemeet.com

blackvikingfashionhouse.com

52banxue.com

girlsinit.com

drhemo.com

freethefarmers.com

velvetrosephotography.com

geometricbotaniclas.com

skyandspirit.com

deltacomunicacao.com

mucademy.com

jaboilfieldsolutions.net

howtowinatblackjacknow.com

anytimegrowth.com

simranluthra.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/624-4-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/624-5-0x000000000041D0E0-mapping.dmp	xloader
behavioral1/memory/1844-6-0x0000000000170000-0x0000000000195000-memory.dmp	xloader
behavioral1/memory/1084-7-0x0000000000000000-mapping.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1432 cmd.exe

pid	process
1432	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Invoice_20210115122010.scrInvoice_20210115122010.scrNAPSTAT.EXE

description	pid	process	target process
PID 1844 set thread context of 624	1844	Invoice_20210115122010.scr	Invoice_20210115122010.scr
PID 624 set thread context of 1200	624	Invoice_20210115122010.scr	Explorer.EXE
PID 1084 set thread context of 1200	1084	NAPSTAT.EXE	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Invoice_20210115122010.scrNAPSTAT.EXE

pid	process
624	Invoice_20210115122010.scr
624	Invoice_20210115122010.scr
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Invoice_20210115122010.scrInvoice_20210115122010.scrNAPSTAT.EXE

pid	process
1844	Invoice_20210115122010.scr
624	Invoice_20210115122010.scr
624	Invoice_20210115122010.scr
624	Invoice_20210115122010.scr
1084	NAPSTAT.EXE
1084	NAPSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Invoice_20210115122010.scrNAPSTAT.EXE

description pid process

Token: SeDebugPrivilege 624 Invoice_20210115122010.scr
Token: SeDebugPrivilege 1084 NAPSTAT.EXE
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1200 Explorer.EXE
1200 Explorer.EXE
1200 Explorer.EXE
1200 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1200 Explorer.EXE
1200 Explorer.EXE
1200 Explorer.EXE
1200 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	624	Invoice_20210115122010.scr
Token: SeDebugPrivilege	1084	NAPSTAT.EXE

pid	process
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE

pid	process
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Invoice_20210115122010.scrExplorer.EXENAPSTAT.EXE

description	pid	process	target process
PID 1844 wrote to memory of 2000	1844	Invoice_20210115122010.scr	cmd.exe
PID 1844 wrote to memory of 2000	1844	Invoice_20210115122010.scr	cmd.exe
PID 1844 wrote to memory of 2000	1844	Invoice_20210115122010.scr	cmd.exe
PID 1844 wrote to memory of 2000	1844	Invoice_20210115122010.scr	cmd.exe
PID 1844 wrote to memory of 1984	1844	Invoice_20210115122010.scr	cmd.exe
PID 1844 wrote to memory of 1984	1844	Invoice_20210115122010.scr	cmd.exe
PID 1844 wrote to memory of 1984	1844	Invoice_20210115122010.scr	cmd.exe
PID 1844 wrote to memory of 1984	1844	Invoice_20210115122010.scr	cmd.exe
PID 1844 wrote to memory of 624	1844	Invoice_20210115122010.scr	Invoice_20210115122010.scr
PID 1844 wrote to memory of 624	1844	Invoice_20210115122010.scr	Invoice_20210115122010.scr
PID 1844 wrote to memory of 624	1844	Invoice_20210115122010.scr	Invoice_20210115122010.scr
PID 1844 wrote to memory of 624	1844	Invoice_20210115122010.scr	Invoice_20210115122010.scr
PID 1844 wrote to memory of 624	1844	Invoice_20210115122010.scr	Invoice_20210115122010.scr
PID 1200 wrote to memory of 1084	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 1084	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 1084	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 1084	1200	Explorer.EXE	NAPSTAT.EXE
PID 1084 wrote to memory of 1432	1084	NAPSTAT.EXE	cmd.exe
PID 1084 wrote to memory of 1432	1084	NAPSTAT.EXE	cmd.exe
PID 1084 wrote to memory of 1432	1084	NAPSTAT.EXE	cmd.exe
PID 1084 wrote to memory of 1432	1084	NAPSTAT.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\Invoice_20210115122010.scr
"C:\Users\Admin\AppData\Local\Temp\Invoice_20210115122010.scr" /S
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2000

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\Invoice_20210115122010.scr
"C:\Users\Admin\AppData\Local\Temp\Invoice_20210115122010.scr" /S
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Invoice_20210115122010.scr"
3⤵
- Deletes itself
PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-4-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/624-5-0x000000000041D0E0-mapping.dmp

Download
memory/1084-7-0x0000000000000000-mapping.dmp

Download
memory/1084-8-0x00000000006B0000-0x00000000006F6000-memory.dmp

Filesize
280KB

Download
memory/1084-10-0x0000000001EA0000-0x0000000001F4D000-memory.dmp

Filesize
692KB

Download
memory/1432-9-0x0000000000000000-mapping.dmp

Download
memory/1844-6-0x0000000000170000-0x0000000000195000-memory.dmp

Filesize
148KB

Download
memory/1984-3-0x0000000000000000-mapping.dmp

Download
memory/2000-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads