formbook | 26b068137a8264f4aba9c3617a289417ead13d0c9d53f86a3158c1d113dbf86d

General

Target

PO#416421.exe
Size

176KB
MD5

18ec4947cbfb82bda1635a855b9b4763
SHA1

6083fb410e0bd21b5bc0f635861758b2747821ab
SHA256

26b068137a8264f4aba9c3617a289417ead13d0c9d53f86a3158c1d113dbf86d
SHA512

3283e0b3e64df7b60b6a71f524f83b107a7ce9d577a147da3a0490bd61c5ffd373887730b33ca347cbf21608ac5cb3bbf6d6d1338377d64eaab5ff8cc5963c72

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.tzmm.net/wpsb/

Decoy

0817ls.com

drawbeirut.com

respiteready.com

yufkayurek.com

poss-plus.com

distributesimilar.com

mcmendzlawns.com

bingent.info

wellnessandcomfort.com

humilityhope.com

recetasfes.com

olala.asia

epochryphal.com

room-lettings-onlines.club

lvc.xyz

reicolee.com

davidmarkphotovideo.photography

corpuschristicarbuyers.com

tutorialyoutube.com

ativ.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2044-5-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1224-12-0x00000000000D0000-0x00000000000F8000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1760 cmd.exe

pid	process
1760	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO#416421.exePO#416421.execmstp.exe

description	pid	process	target process
PID 644 set thread context of 2044	644	PO#416421.exe	PO#416421.exe
PID 2044 set thread context of 1264	2044	PO#416421.exe	Explorer.EXE
PID 1224 set thread context of 1264	1224	cmstp.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

PO#416421.execmstp.exe

pid	process
2044	PO#416421.exe
2044	PO#416421.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe
1224	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

PO#416421.exePO#416421.execmstp.exe

pid process

644 PO#416421.exe
2044 PO#416421.exe
2044 PO#416421.exe
2044 PO#416421.exe
1224 cmstp.exe
1224 cmstp.exe

pid	process
1264	Explorer.EXE

pid	process
644	PO#416421.exe
2044	PO#416421.exe
2044	PO#416421.exe
2044	PO#416421.exe
1224	cmstp.exe
1224	cmstp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PO#416421.execmstp.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2044	PO#416421.exe
Token: SeDebugPrivilege	1224	cmstp.exe
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeShutdownPrivilege	1264	Explorer.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE

pid	process
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

pid	process
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

PO#416421.exeExplorer.EXEcmstp.exe

description	pid	process	target process
PID 644 wrote to memory of 2036	644	PO#416421.exe	cmd.exe
PID 644 wrote to memory of 2036	644	PO#416421.exe	cmd.exe
PID 644 wrote to memory of 2036	644	PO#416421.exe	cmd.exe
PID 644 wrote to memory of 2036	644	PO#416421.exe	cmd.exe
PID 644 wrote to memory of 2044	644	PO#416421.exe	PO#416421.exe
PID 644 wrote to memory of 2044	644	PO#416421.exe	PO#416421.exe
PID 644 wrote to memory of 2044	644	PO#416421.exe	PO#416421.exe
PID 644 wrote to memory of 2044	644	PO#416421.exe	PO#416421.exe
PID 644 wrote to memory of 2044	644	PO#416421.exe	PO#416421.exe
PID 1264 wrote to memory of 1224	1264	Explorer.EXE	cmstp.exe
PID 1264 wrote to memory of 1224	1264	Explorer.EXE	cmstp.exe
PID 1264 wrote to memory of 1224	1264	Explorer.EXE	cmstp.exe
PID 1264 wrote to memory of 1224	1264	Explorer.EXE	cmstp.exe
PID 1264 wrote to memory of 1224	1264	Explorer.EXE	cmstp.exe
PID 1264 wrote to memory of 1224	1264	Explorer.EXE	cmstp.exe
PID 1264 wrote to memory of 1224	1264	Explorer.EXE	cmstp.exe
PID 1224 wrote to memory of 1760	1224	cmstp.exe	cmd.exe
PID 1224 wrote to memory of 1760	1224	cmstp.exe	cmd.exe
PID 1224 wrote to memory of 1760	1224	cmstp.exe	cmd.exe
PID 1224 wrote to memory of 1760	1224	cmstp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\PO#416421.exe
"C:\Users\Admin\AppData\Local\Temp\PO#416421.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2036

C:\Users\Admin\AppData\Local\Temp\PO#416421.exe
"C:\Users\Admin\AppData\Local\Temp\PO#416421.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\PO#416421.exe"
3⤵
- Deletes itself
PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-2-0x00000000765E1000-0x00000000765E3000-memory.dmp

Filesize
8KB

Download
memory/1224-15-0x0000000000430000-0x00000000004BF000-memory.dmp

Filesize
572KB

Download
memory/1224-14-0x00000000020D0000-0x00000000023D3000-memory.dmp

Filesize
3.0MB

Download
memory/1224-12-0x00000000000D0000-0x00000000000F8000-memory.dmp

Filesize
160KB

Download
memory/1224-11-0x0000000000CB0000-0x0000000000CC8000-memory.dmp

Filesize
96KB

Download
memory/1224-9-0x0000000000000000-mapping.dmp

Download
memory/1264-8-0x0000000006CA0000-0x0000000006DB5000-memory.dmp

Filesize
1.1MB

Download
memory/1264-16-0x0000000006DC0000-0x0000000006F0A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-13-0x0000000000000000-mapping.dmp

Download
memory/2036-3-0x0000000000000000-mapping.dmp

Download
memory/2044-7-0x00000000000E0000-0x00000000000F0000-memory.dmp

Filesize
64KB

Download
memory/2044-6-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/2044-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2044-4-0x000000000041D040-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads