formbook | b88d84be2994a05ac716dac99a689356d8c7ecbd541989a5339be403da909430

General

Target

ec93682406cb590651215da741f3c8d1.exe
Size

475KB
MD5

ec93682406cb590651215da741f3c8d1
SHA1

cc6243df7e6b835bf476a41023b8ff4ebb66b9ac
SHA256

b88d84be2994a05ac716dac99a689356d8c7ecbd541989a5339be403da909430
SHA512

8bcacb9f570546494d0c0c7c301f1d5e6ddf0b20d3af6d2652241e35aaf905e7c46598344413b59ec41f517f6515488749e7df9e5705d523a755013fe6199934

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.inreachpt.com/gqx2/

Decoy

calusaptamiami.com

starlinkwebservices.com

lakeviewbarbershonola.com

oaklandraidersjerseyspop.com

ohiotechreport.com

eligetucafetera.com

tu4343.com

abstract-elearning.com

thebabylashes.com

athleteshive.com

fanninhomesforless.com

sembracna.com

servicesyn.com

bellairechoice.com

tmpaas.com

eyepaa.com

stickerzblvd.com

rentfs.com

nadya-shanab.com

microwgreens.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1264-7-0x000000000041D070-mapping.dmp	xloader
behavioral1/memory/1264-6-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

ec93682406cb590651215da741f3c8d1.exe

description pid process target process

PID 1096 set thread context of 1264 1096 ec93682406cb590651215da741f3c8d1.exe ec93682406cb590651215da741f3c8d1.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1968 1096 WerFault.exe ec93682406cb590651215da741f3c8d1.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ec93682406cb590651215da741f3c8d1.exeWerFault.exe

pid process

1264 ec93682406cb590651215da741f3c8d1.exe
1968 WerFault.exe
1968 WerFault.exe
1968 WerFault.exe
1968 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1968 WerFault.exe

description	pid	process	target process
PID 1096 set thread context of 1264	1096	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe

pid	pid_target	process	target process
1968	1096	WerFault.exe	ec93682406cb590651215da741f3c8d1.exe

pid	process
1264	ec93682406cb590651215da741f3c8d1.exe
1968	WerFault.exe
1968	WerFault.exe
1968	WerFault.exe
1968	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1968	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ec93682406cb590651215da741f3c8d1.exe

description	pid	process	target process
PID 1096 wrote to memory of 1264	1096	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 1096 wrote to memory of 1264	1096	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 1096 wrote to memory of 1264	1096	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 1096 wrote to memory of 1264	1096	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 1096 wrote to memory of 1264	1096	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 1096 wrote to memory of 1264	1096	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 1096 wrote to memory of 1264	1096	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 1096 wrote to memory of 1968	1096	ec93682406cb590651215da741f3c8d1.exe	WerFault.exe
PID 1096 wrote to memory of 1968	1096	ec93682406cb590651215da741f3c8d1.exe	WerFault.exe
PID 1096 wrote to memory of 1968	1096	ec93682406cb590651215da741f3c8d1.exe	WerFault.exe
PID 1096 wrote to memory of 1968	1096	ec93682406cb590651215da741f3c8d1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ec93682406cb590651215da741f3c8d1.exe
"C:\Users\Admin\AppData\Local\Temp\ec93682406cb590651215da741f3c8d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\ec93682406cb590651215da741f3c8d1.exe
"C:\Users\Admin\AppData\Local\Temp\ec93682406cb590651215da741f3c8d1.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 840
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-2-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/1096-3-0x0000000001200000-0x0000000001201000-memory.dmp

Filesize
4KB

Download
memory/1096-4-0x00000000004E0000-0x0000000000536000-memory.dmp

Filesize
344KB

Download
memory/1096-5-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/1096-8-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/1264-7-0x000000000041D070-mapping.dmp

Download
memory/1264-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1264-12-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/1968-9-0x0000000000000000-mapping.dmp

Download
memory/1968-11-0x0000000001DA0000-0x0000000001DB1000-memory.dmp

Filesize
68KB

Download
memory/1968-13-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing