formbook | 26b068137a8264f4aba9c3617a289417ead13d0c9d53f86a3158c1d113dbf86d

General

Target

PO#416421.exe
Size

176KB
MD5

18ec4947cbfb82bda1635a855b9b4763
SHA1

6083fb410e0bd21b5bc0f635861758b2747821ab
SHA256

26b068137a8264f4aba9c3617a289417ead13d0c9d53f86a3158c1d113dbf86d
SHA512

3283e0b3e64df7b60b6a71f524f83b107a7ce9d577a147da3a0490bd61c5ffd373887730b33ca347cbf21608ac5cb3bbf6d6d1338377d64eaab5ff8cc5963c72

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.tzmm.net/wpsb/

Decoy

0817ls.com

drawbeirut.com

respiteready.com

yufkayurek.com

poss-plus.com

distributesimilar.com

mcmendzlawns.com

bingent.info

wellnessandcomfort.com

humilityhope.com

recetasfes.com

olala.asia

epochryphal.com

room-lettings-onlines.club

lvc.xyz

reicolee.com

davidmarkphotovideo.photography

corpuschristicarbuyers.com

tutorialyoutube.com

ativ.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3828-4-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/3948-10-0x00000000021D0000-0x00000000021F8000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO#416421.exePO#416421.exeraserver.exe

description	pid	process	target process
PID 580 set thread context of 3828	580	PO#416421.exe	PO#416421.exe
PID 3828 set thread context of 3032	3828	PO#416421.exe	Explorer.EXE
PID 3948 set thread context of 3032	3948	raserver.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

PO#416421.exeraserver.exe

pid	process
3828	PO#416421.exe
3828	PO#416421.exe
3828	PO#416421.exe
3828	PO#416421.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe
3948	raserver.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

PO#416421.exePO#416421.exeraserver.exe

pid process

580 PO#416421.exe
3828 PO#416421.exe
3828 PO#416421.exe
3828 PO#416421.exe
3948 raserver.exe
3948 raserver.exe

pid	process
580	PO#416421.exe
3828	PO#416421.exe
3828	PO#416421.exe
3828	PO#416421.exe
3948	raserver.exe
3948	raserver.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

PO#416421.exeraserver.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3828	PO#416421.exe
Token: SeDebugPrivilege	3948	raserver.exe
Token: SeShutdownPrivilege	3032	Explorer.EXE
Token: SeCreatePagefilePrivilege	3032	Explorer.EXE
Token: SeShutdownPrivilege	3032	Explorer.EXE
Token: SeCreatePagefilePrivilege	3032	Explorer.EXE
Token: SeShutdownPrivilege	3032	Explorer.EXE
Token: SeCreatePagefilePrivilege	3032	Explorer.EXE
Token: SeShutdownPrivilege	3032	Explorer.EXE
Token: SeCreatePagefilePrivilege	3032	Explorer.EXE
Token: SeShutdownPrivilege	3032	Explorer.EXE
Token: SeCreatePagefilePrivilege	3032	Explorer.EXE
Token: SeShutdownPrivilege	3032	Explorer.EXE
Token: SeCreatePagefilePrivilege	3032	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PO#416421.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 580 wrote to memory of 748	580	PO#416421.exe	cmd.exe
PID 580 wrote to memory of 748	580	PO#416421.exe	cmd.exe
PID 580 wrote to memory of 748	580	PO#416421.exe	cmd.exe
PID 580 wrote to memory of 3828	580	PO#416421.exe	PO#416421.exe
PID 580 wrote to memory of 3828	580	PO#416421.exe	PO#416421.exe
PID 580 wrote to memory of 3828	580	PO#416421.exe	PO#416421.exe
PID 580 wrote to memory of 3828	580	PO#416421.exe	PO#416421.exe
PID 3032 wrote to memory of 3948	3032	Explorer.EXE	raserver.exe
PID 3032 wrote to memory of 3948	3032	Explorer.EXE	raserver.exe
PID 3032 wrote to memory of 3948	3032	Explorer.EXE	raserver.exe
PID 3948 wrote to memory of 1800	3948	raserver.exe	cmd.exe
PID 3948 wrote to memory of 1800	3948	raserver.exe	cmd.exe
PID 3948 wrote to memory of 1800	3948	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032

C:\Users\Admin\AppData\Local\Temp\PO#416421.exe
"C:\Users\Admin\AppData\Local\Temp\PO#416421.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\PO#416421.exe
"C:\Users\Admin\AppData\Local\Temp\PO#416421.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\PO#416421.exe"
3⤵
PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-2-0x0000000000000000-mapping.dmp

Download
memory/1800-11-0x0000000000000000-mapping.dmp

Download
memory/3032-7-0x0000000005050000-0x0000000005166000-memory.dmp

Filesize
1.1MB

Download
memory/3032-14-0x0000000005170000-0x00000000052AA000-memory.dmp

Filesize
1.2MB

Download
memory/3828-5-0x00000000012F0000-0x0000000001610000-memory.dmp

Filesize
3.1MB

Download
memory/3828-6-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/3828-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3828-3-0x000000000041D040-mapping.dmp

Download
memory/3948-8-0x0000000000000000-mapping.dmp

Download
memory/3948-10-0x00000000021D0000-0x00000000021F8000-memory.dmp

Filesize
160KB

Download
memory/3948-9-0x0000000000030000-0x000000000004F000-memory.dmp

Filesize
124KB

Download
memory/3948-12-0x00000000042E0000-0x0000000004600000-memory.dmp

Filesize
3.1MB

Download
memory/3948-13-0x0000000004140000-0x00000000041CF000-memory.dmp

Filesize
572KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads