formbook | 63289870bb6e2bbb13afd47bf630c048e593afacc5c968939855f85ca5022ea4

General

Target

786180a5141bf4ea48e26910d2bf9061.exe
Size

889KB
MD5

786180a5141bf4ea48e26910d2bf9061
SHA1

f77224c2ac0c9dd746fc22b102da2a534bf889e2
SHA256

63289870bb6e2bbb13afd47bf630c048e593afacc5c968939855f85ca5022ea4
SHA512

cbdb00fe20e39c52ac736e75bc2c93abecc0d0ecbc9c10d7b62e88f6e574f99ee545a5ca34578dcdc564cd32fe3e9fb1258bc35d09304b094a32c2f89a492d28

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.stonescapes1.com/de92/

Decoy

zindaginews.com

tyelevator.com

schustermaninterests.com

algemixdelchef.com

doubscollectivites.com

e-butchery.com

hellbentmask.com

jumbpprivacy.com

teeniestiedye.com

playfulartwork.com

desertvacahs.com

w5470-hed.net

nepalearningpods.com

smoothandsleek.com

thecannaglow.com

torrentkittyla.com

industrytoyou.com

raquelvargas.net

rlc-nc.net

cryptoprises.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1976-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/1976-13-0x000000000041D010-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

786180a5141bf4ea48e26910d2bf9061.exe

description pid process target process

PID 812 set thread context of 1976 812 786180a5141bf4ea48e26910d2bf9061.exe 786180a5141bf4ea48e26910d2bf9061.exe

description	pid	process	target process
PID 812 set thread context of 1976	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

786180a5141bf4ea48e26910d2bf9061.exe786180a5141bf4ea48e26910d2bf9061.exe

pid	process
812	786180a5141bf4ea48e26910d2bf9061.exe
812	786180a5141bf4ea48e26910d2bf9061.exe
1976	786180a5141bf4ea48e26910d2bf9061.exe
1976	786180a5141bf4ea48e26910d2bf9061.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

786180a5141bf4ea48e26910d2bf9061.exe

description pid process

Token: SeDebugPrivilege 812 786180a5141bf4ea48e26910d2bf9061.exe

description	pid	process
Token: SeDebugPrivilege	812	786180a5141bf4ea48e26910d2bf9061.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

786180a5141bf4ea48e26910d2bf9061.exe

description	pid	process	target process
PID 812 wrote to memory of 3764	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe
PID 812 wrote to memory of 3764	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe
PID 812 wrote to memory of 3764	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe
PID 812 wrote to memory of 1976	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe
PID 812 wrote to memory of 1976	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe
PID 812 wrote to memory of 1976	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe
PID 812 wrote to memory of 1976	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe
PID 812 wrote to memory of 1976	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe
PID 812 wrote to memory of 1976	812	786180a5141bf4ea48e26910d2bf9061.exe	786180a5141bf4ea48e26910d2bf9061.exe

C:\Users\Admin\AppData\Local\Temp\786180a5141bf4ea48e26910d2bf9061.exe
"C:\Users\Admin\AppData\Local\Temp\786180a5141bf4ea48e26910d2bf9061.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Local\Temp\786180a5141bf4ea48e26910d2bf9061.exe
"{path}"
2⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\786180a5141bf4ea48e26910d2bf9061.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-2-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/812-3-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/812-5-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/812-6-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/812-7-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/812-8-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/812-9-0x0000000004ED0000-0x0000000004EDE000-memory.dmp

Filesize
56KB

Download
memory/812-10-0x0000000006AB0000-0x0000000006B07000-memory.dmp

Filesize
348KB

Download
memory/812-11-0x0000000007130000-0x0000000007131000-memory.dmp

Filesize
4KB

Download
memory/1976-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1976-13-0x000000000041D010-mapping.dmp

Download
memory/1976-15-0x0000000001900000-0x0000000001C20000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads