formbook | d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf

General

Target

SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
Size

276KB
MD5

4755bdfa1fb87c626856b33c48419201
SHA1

c174cf847aa3e0a06128626c13608a3a5421e0f4
SHA256

d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf
SHA512

d7e982eb367ee0813dcdb92604f3f444c88603dc1aa6c5c14d397d7a43dfbedc7ee9280b3674a8715c4cab8c24176f4efa24d5cf206596b5e21cdc40c467c5ca

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.hitchhikerfab.com/qjnt/

Decoy

silverlakesfootball.com

drivebymovie.com

precisedirections.com

xn--01-mlcpq1abi.xn--p1acf

landhubturkey.com

andronomicon.com

kindlyhomecare.com

tyequip.com

planfra.com

wy1197.com

blackcatbaker.com

ddhhynjy.com

sales-altigen.com

valerielimozin.com

walmamall.com

quishkambalito.com

gnbsuvm.icu

milanostorear.com

olympiaopen.com

zradydlyazhinok-ua.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1924-3-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1924-4-0x000000000041D030-mapping.dmp	xloader
behavioral1/memory/800-6-0x00000000003A0000-0x00000000003CA000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe

description	pid	process	target process
PID 800 set thread context of 1924	800	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe

pid process

1924 SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe

pid	process
1924	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe

description	pid	process	target process
PID 800 wrote to memory of 1924	800	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
PID 800 wrote to memory of 1924	800	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
PID 800 wrote to memory of 1924	800	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
PID 800 wrote to memory of 1924	800	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
PID 800 wrote to memory of 1924	800	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
PID 800 wrote to memory of 1924	800	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
PID 800 wrote to memory of 1924	800	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-2-0x0000000004E50000-0x0000000004E61000-memory.dmp

Filesize
68KB

Download
memory/800-6-0x00000000003A0000-0x00000000003CA000-memory.dmp

Filesize
168KB

Download
memory/800-5-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/1924-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1924-4-0x000000000041D030-mapping.dmp

Download
memory/1924-8-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads