formbook | b88d84be2994a05ac716dac99a689356d8c7ecbd541989a5339be403da909430

General

Target

ec93682406cb590651215da741f3c8d1.exe
Size

475KB
MD5

ec93682406cb590651215da741f3c8d1
SHA1

cc6243df7e6b835bf476a41023b8ff4ebb66b9ac
SHA256

b88d84be2994a05ac716dac99a689356d8c7ecbd541989a5339be403da909430
SHA512

8bcacb9f570546494d0c0c7c301f1d5e6ddf0b20d3af6d2652241e35aaf905e7c46598344413b59ec41f517f6515488749e7df9e5705d523a755013fe6199934

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.inreachpt.com/gqx2/

Decoy

calusaptamiami.com

starlinkwebservices.com

lakeviewbarbershonola.com

oaklandraidersjerseyspop.com

ohiotechreport.com

eligetucafetera.com

tu4343.com

abstract-elearning.com

thebabylashes.com

athleteshive.com

fanninhomesforless.com

sembracna.com

servicesyn.com

bellairechoice.com

tmpaas.com

eyepaa.com

stickerzblvd.com

rentfs.com

nadya-shanab.com

microwgreens.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2480-10-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2480-11-0x000000000041D070-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

ec93682406cb590651215da741f3c8d1.exe

description pid process target process

PID 4056 set thread context of 2480 4056 ec93682406cb590651215da741f3c8d1.exe ec93682406cb590651215da741f3c8d1.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3488 4056 WerFault.exe ec93682406cb590651215da741f3c8d1.exe

description	pid	process	target process
PID 4056 set thread context of 2480	4056	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe

pid	pid_target	process	target process
3488	4056	WerFault.exe	ec93682406cb590651215da741f3c8d1.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

ec93682406cb590651215da741f3c8d1.exeWerFault.exe

pid	process
2480	ec93682406cb590651215da741f3c8d1.exe
2480	ec93682406cb590651215da741f3c8d1.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe
3488	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3488 WerFault.exe
Token: SeBackupPrivilege 3488 WerFault.exe
Token: SeDebugPrivilege 3488 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3488	WerFault.exe
Token: SeBackupPrivilege	3488	WerFault.exe
Token: SeDebugPrivilege	3488	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ec93682406cb590651215da741f3c8d1.exe

description	pid	process	target process
PID 4056 wrote to memory of 2480	4056	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 4056 wrote to memory of 2480	4056	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 4056 wrote to memory of 2480	4056	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 4056 wrote to memory of 2480	4056	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 4056 wrote to memory of 2480	4056	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe
PID 4056 wrote to memory of 2480	4056	ec93682406cb590651215da741f3c8d1.exe	ec93682406cb590651215da741f3c8d1.exe

C:\Users\Admin\AppData\Local\Temp\ec93682406cb590651215da741f3c8d1.exe
"C:\Users\Admin\AppData\Local\Temp\ec93682406cb590651215da741f3c8d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4056

C:\Users\Admin\AppData\Local\Temp\ec93682406cb590651215da741f3c8d1.exe
"C:\Users\Admin\AppData\Local\Temp\ec93682406cb590651215da741f3c8d1.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 1364
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2480-17-0x0000000001490000-0x00000000017B0000-memory.dmp

Filesize
3.1MB

Download
memory/2480-11-0x000000000041D070-mapping.dmp

Download
memory/3488-16-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/4056-5-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/4056-7-0x0000000004F60000-0x0000000004FB6000-memory.dmp

Filesize
344KB

Download
memory/4056-8-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/4056-9-0x0000000005520000-0x000000000552F000-memory.dmp

Filesize
60KB

Download
memory/4056-6-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/4056-2-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Filesize
6.9MB

Download
memory/4056-12-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/4056-14-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/4056-15-0x0000000005C20000-0x0000000005C21000-memory.dmp

Filesize
4KB

Download
memory/4056-4-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/4056-3-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads