formbook | a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4

General

Target

08554cb035e1c8f14b980019ffae237c.exe
Size

1.4MB
MD5

08554cb035e1c8f14b980019ffae237c
SHA1

2d64711f6503c3b6ffd792aa0119efffae61883d
SHA256

a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
SHA512

540d02b2748201c115ef4d763d78167bc3d659fd75f927e7750c5aee8a7d6c268f7b80ff6c5d7df49555c5f3c9175760275f337b8bbeba558d83b9586f93a094

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.stonescapes1.com/de92/

Decoy

zindaginews.com

tyelevator.com

schustermaninterests.com

algemixdelchef.com

doubscollectivites.com

e-butchery.com

hellbentmask.com

jumbpprivacy.com

teeniestiedye.com

playfulartwork.com

desertvacahs.com

w5470-hed.net

nepalearningpods.com

smoothandsleek.com

thecannaglow.com

torrentkittyla.com

industrytoyou.com

raquelvargas.net

rlc-nc.net

cryptoprises.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/528-14-0x000000000041D010-mapping.dmp	xloader
behavioral2/memory/528-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

08554cb035e1c8f14b980019ffae237c.exe

description pid process target process

PID 4764 set thread context of 528 4764 08554cb035e1c8f14b980019ffae237c.exe 08554cb035e1c8f14b980019ffae237c.exe

description	pid	process	target process
PID 4764 set thread context of 528	4764	08554cb035e1c8f14b980019ffae237c.exe	08554cb035e1c8f14b980019ffae237c.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

08554cb035e1c8f14b980019ffae237c.exe08554cb035e1c8f14b980019ffae237c.exe

pid	process
4764	08554cb035e1c8f14b980019ffae237c.exe
4764	08554cb035e1c8f14b980019ffae237c.exe
4764	08554cb035e1c8f14b980019ffae237c.exe
528	08554cb035e1c8f14b980019ffae237c.exe
528	08554cb035e1c8f14b980019ffae237c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

08554cb035e1c8f14b980019ffae237c.exe

description pid process

Token: SeDebugPrivilege 4764 08554cb035e1c8f14b980019ffae237c.exe

description	pid	process
Token: SeDebugPrivilege	4764	08554cb035e1c8f14b980019ffae237c.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

08554cb035e1c8f14b980019ffae237c.exe

description	pid	process	target process
PID 4764 wrote to memory of 528	4764	08554cb035e1c8f14b980019ffae237c.exe	08554cb035e1c8f14b980019ffae237c.exe
PID 4764 wrote to memory of 528	4764	08554cb035e1c8f14b980019ffae237c.exe	08554cb035e1c8f14b980019ffae237c.exe
PID 4764 wrote to memory of 528	4764	08554cb035e1c8f14b980019ffae237c.exe	08554cb035e1c8f14b980019ffae237c.exe
PID 4764 wrote to memory of 528	4764	08554cb035e1c8f14b980019ffae237c.exe	08554cb035e1c8f14b980019ffae237c.exe
PID 4764 wrote to memory of 528	4764	08554cb035e1c8f14b980019ffae237c.exe	08554cb035e1c8f14b980019ffae237c.exe
PID 4764 wrote to memory of 528	4764	08554cb035e1c8f14b980019ffae237c.exe	08554cb035e1c8f14b980019ffae237c.exe

C:\Users\Admin\AppData\Local\Temp\08554cb035e1c8f14b980019ffae237c.exe
"C:\Users\Admin\AppData\Local\Temp\08554cb035e1c8f14b980019ffae237c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764

C:\Users\Admin\AppData\Local\Temp\08554cb035e1c8f14b980019ffae237c.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:528

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-14-0x000000000041D010-mapping.dmp

Download
memory/528-16-0x0000000001710000-0x0000000001A30000-memory.dmp

Filesize
3.1MB

Download
memory/528-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4764-9-0x0000000005170000-0x000000000517E000-memory.dmp

Filesize
56KB

Download
memory/4764-7-0x000000000A820000-0x000000000A821000-memory.dmp

Filesize
4KB

Download
memory/4764-8-0x000000000A7C0000-0x000000000A7C1000-memory.dmp

Filesize
4KB

Download
memory/4764-2-0x0000000073150000-0x000000007383E000-memory.dmp

Filesize
6.9MB

Download
memory/4764-10-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/4764-11-0x0000000005510000-0x0000000005565000-memory.dmp

Filesize
340KB

Download
memory/4764-12-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/4764-6-0x000000000AC40000-0x000000000AC41000-memory.dmp

Filesize
4KB

Download
memory/4764-5-0x00000000073C0000-0x0000000007436000-memory.dmp

Filesize
472KB

Download
memory/4764-3-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads