formbook | 518023c16668547a3d37cd93ca34ae6697364dd838c8538d6de80441f2b6c1bd

General

Target

Purchase_Order_4501470158_request_for_quatation_09488588.exe
Size

937KB
MD5

0ef28ea7498111382b1830d2f0e0f3b8
SHA1

9d7227efbfdc8f3340ccb7caf36ba48abd1f33ed
SHA256

518023c16668547a3d37cd93ca34ae6697364dd838c8538d6de80441f2b6c1bd
SHA512

4e01be4a974b894a4efba8cc00430b3aa536ad544db07e4833d90cac877779c4763d71adaccc35f286d94c60a670436973e6f4925b7b21bdc8049910a161620c

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1628-8-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1628-9-0x000000000041D070-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

Purchase_Order_4501470158_request_for_quatation_09488588.exe

description	pid	process	target process
PID 784 set thread context of 1628	784	Purchase_Order_4501470158_request_for_quatation_09488588.exe	Purchase_Order_4501470158_request_for_quatation_09488588.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Purchase_Order_4501470158_request_for_quatation_09488588.exe

pid process

1628 Purchase_Order_4501470158_request_for_quatation_09488588.exe

pid	process
1628	Purchase_Order_4501470158_request_for_quatation_09488588.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Purchase_Order_4501470158_request_for_quatation_09488588.exe

description	pid	process	target process
PID 784 wrote to memory of 1628	784	Purchase_Order_4501470158_request_for_quatation_09488588.exe	Purchase_Order_4501470158_request_for_quatation_09488588.exe
PID 784 wrote to memory of 1628	784	Purchase_Order_4501470158_request_for_quatation_09488588.exe	Purchase_Order_4501470158_request_for_quatation_09488588.exe
PID 784 wrote to memory of 1628	784	Purchase_Order_4501470158_request_for_quatation_09488588.exe	Purchase_Order_4501470158_request_for_quatation_09488588.exe
PID 784 wrote to memory of 1628	784	Purchase_Order_4501470158_request_for_quatation_09488588.exe	Purchase_Order_4501470158_request_for_quatation_09488588.exe
PID 784 wrote to memory of 1628	784	Purchase_Order_4501470158_request_for_quatation_09488588.exe	Purchase_Order_4501470158_request_for_quatation_09488588.exe
PID 784 wrote to memory of 1628	784	Purchase_Order_4501470158_request_for_quatation_09488588.exe	Purchase_Order_4501470158_request_for_quatation_09488588.exe
PID 784 wrote to memory of 1628	784	Purchase_Order_4501470158_request_for_quatation_09488588.exe	Purchase_Order_4501470158_request_for_quatation_09488588.exe

C:\Users\Admin\AppData\Local\Temp\Purchase_Order_4501470158_request_for_quatation_09488588.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase_Order_4501470158_request_for_quatation_09488588.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\Purchase_Order_4501470158_request_for_quatation_09488588.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-2-0x0000000073D40000-0x000000007442E000-memory.dmp

Filesize
6.9MB

Download
memory/784-3-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/784-5-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/784-6-0x0000000000390000-0x000000000039E000-memory.dmp

Filesize
56KB

Download
memory/784-7-0x0000000004300000-0x0000000004353000-memory.dmp

Filesize
332KB

Download
memory/1628-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1628-9-0x000000000041D070-mapping.dmp

Download
memory/1628-11-0x0000000000A60000-0x0000000000D63000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads