formbook | 2ad7e15e59c05d71f2682a81f2bf2872eb4421b343a4c4b96748a31064445494

General

Target

f3d7308ba02ae2418b7133bb54af2f2f.exe
Size

1.0MB
MD5

f3d7308ba02ae2418b7133bb54af2f2f
SHA1

abc7f14b9c5305c7d127ad53d0f0c9cd17af3b07
SHA256

2ad7e15e59c05d71f2682a81f2bf2872eb4421b343a4c4b96748a31064445494
SHA512

a4254e767a3eeb26783fc31b75f4e561938ce3b43f4872ae24f12b0f9ec421f2ac3b3c659f35da560bc247686658edfa4155ba8c08a2621b45237f14e234855c

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2144-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/2144-14-0x000000000041CFF0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f3d7308ba02ae2418b7133bb54af2f2f.exe

description pid process target process

PID 4000 set thread context of 2144 4000 f3d7308ba02ae2418b7133bb54af2f2f.exe f3d7308ba02ae2418b7133bb54af2f2f.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f3d7308ba02ae2418b7133bb54af2f2f.exe

pid process

2144 f3d7308ba02ae2418b7133bb54af2f2f.exe
2144 f3d7308ba02ae2418b7133bb54af2f2f.exe

description	pid	process	target process
PID 4000 set thread context of 2144	4000	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe

pid	process
2144	f3d7308ba02ae2418b7133bb54af2f2f.exe
2144	f3d7308ba02ae2418b7133bb54af2f2f.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f3d7308ba02ae2418b7133bb54af2f2f.exe

description	pid	process	target process
PID 4000 wrote to memory of 2144	4000	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 4000 wrote to memory of 2144	4000	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 4000 wrote to memory of 2144	4000	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 4000 wrote to memory of 2144	4000	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 4000 wrote to memory of 2144	4000	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe
PID 4000 wrote to memory of 2144	4000	f3d7308ba02ae2418b7133bb54af2f2f.exe	f3d7308ba02ae2418b7133bb54af2f2f.exe

C:\Users\Admin\AppData\Local\Temp\f3d7308ba02ae2418b7133bb54af2f2f.exe
"C:\Users\Admin\AppData\Local\Temp\f3d7308ba02ae2418b7133bb54af2f2f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000

C:\Users\Admin\AppData\Local\Temp\f3d7308ba02ae2418b7133bb54af2f2f.exe
"C:\Users\Admin\AppData\Local\Temp\f3d7308ba02ae2418b7133bb54af2f2f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2144

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2144-16-0x0000000001470000-0x0000000001790000-memory.dmp

Filesize
3.1MB

Download
memory/2144-14-0x000000000041CFF0-mapping.dmp

Download
memory/4000-9-0x0000000007C70000-0x0000000007C71000-memory.dmp

Filesize
4KB

Download
memory/4000-7-0x0000000007B10000-0x0000000007B11000-memory.dmp

Filesize
4KB

Download
memory/4000-8-0x00000000079D0000-0x00000000079D1000-memory.dmp

Filesize
4KB

Download
memory/4000-2-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/4000-10-0x0000000007D10000-0x0000000007D33000-memory.dmp

Filesize
140KB

Download
memory/4000-11-0x0000000007D00000-0x0000000007D01000-memory.dmp

Filesize
4KB

Download
memory/4000-12-0x0000000008630000-0x0000000008691000-memory.dmp

Filesize
388KB

Download
memory/4000-6-0x0000000008010000-0x0000000008011000-memory.dmp

Filesize
4KB

Download
memory/4000-5-0x0000000007A70000-0x0000000007A71000-memory.dmp

Filesize
4KB

Download
memory/4000-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing