formbook | 2ad7e15e59c05d71f2682a81f2bf2872eb4421b343a4c4b96748a31064445494

General

Target

f3d7308ba02ae2418b7133bb54af2f2f.exe
Size

1.0MB
MD5

f3d7308ba02ae2418b7133bb54af2f2f
SHA1

abc7f14b9c5305c7d127ad53d0f0c9cd17af3b07
SHA256

2ad7e15e59c05d71f2682a81f2bf2872eb4421b343a4c4b96748a31064445494
SHA512

a4254e767a3eeb26783fc31b75f4e561938ce3b43f4872ae24f12b0f9ec421f2ac3b3c659f35da560bc247686658edfa4155ba8c08a2621b45237f14e234855c

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1364-8-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1364-9-0x000000000041CFF0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f3d7308ba02ae2418b7133bb54af2f2f.exe

description pid process target process

PID 1088 set thread context of 1364 1088 f3d7308ba02ae2418b7133bb54af2f2f.exe f3d7308ba02ae2418b7133bb54af2f2f.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f3d7308ba02ae2418b7133bb54af2f2f.exe

pid process

1364 f3d7308ba02ae2418b7133bb54af2f2f.exe

description	pid	process	target process
PID 1088 set thread context of 1364	1088	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe

pid	process
1364	f3d7308ba02ae2418b7133bb54af2f2f.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f3d7308ba02ae2418b7133bb54af2f2f.exe

description	pid	process	target process
PID 1088 wrote to memory of 1364	1088	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 1088 wrote to memory of 1364	1088	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 1088 wrote to memory of 1364	1088	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 1088 wrote to memory of 1364	1088	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 1088 wrote to memory of 1364	1088	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 1088 wrote to memory of 1364	1088	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 1088 wrote to memory of 1364	1088	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe

C:\Users\Admin\AppData\Local\Temp\f3d7308ba02ae2418b7133bb54af2f2f.exe
"C:\Users\Admin\AppData\Local\Temp\f3d7308ba02ae2418b7133bb54af2f2f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\f3d7308ba02ae2418b7133bb54af2f2f.exe
"C:\Users\Admin\AppData\Local\Temp\f3d7308ba02ae2418b7133bb54af2f2f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1088-3-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/1088-5-0x0000000007180000-0x0000000007181000-memory.dmp

Filesize
4KB

Download
memory/1088-6-0x0000000000550000-0x0000000000573000-memory.dmp

Filesize
140KB

Download
memory/1088-7-0x0000000007400000-0x0000000007461000-memory.dmp

Filesize
388KB

Download
memory/1364-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1364-9-0x000000000041CFF0-mapping.dmp

Download
memory/1364-11-0x0000000000C30000-0x0000000000F33000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing