formbook | 750292519a4b694e981556bdaec9c5b568ac54f1b9cb52fc1f740cd45b2748ec

General

Target

d4ecd2bd3d00a12dffcf55e006eb7b24.exe
Size

1.0MB
MD5

d4ecd2bd3d00a12dffcf55e006eb7b24
SHA1

99b1322240a29fc6497493c903d179c55676c613
SHA256

750292519a4b694e981556bdaec9c5b568ac54f1b9cb52fc1f740cd45b2748ec
SHA512

31e79736b401f0434f1c71d7694e28989fb5881ad25673abe4893ae1d116a35e5316471d4fc6f96a4f8cd2b23075b3e437139c8e538e3849d8afafc9199ab546

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1728-8-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1728-9-0x000000000041CFF0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

d4ecd2bd3d00a12dffcf55e006eb7b24.exe

description pid process target process

PID 1668 set thread context of 1728 1668 d4ecd2bd3d00a12dffcf55e006eb7b24.exe d4ecd2bd3d00a12dffcf55e006eb7b24.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d4ecd2bd3d00a12dffcf55e006eb7b24.exe

pid process

1728 d4ecd2bd3d00a12dffcf55e006eb7b24.exe

description	pid	process	target process
PID 1668 set thread context of 1728	1668	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe

pid	process
1728	d4ecd2bd3d00a12dffcf55e006eb7b24.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d4ecd2bd3d00a12dffcf55e006eb7b24.exe

description	pid	process	target process
PID 1668 wrote to memory of 1728	1668	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 1668 wrote to memory of 1728	1668	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 1668 wrote to memory of 1728	1668	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 1668 wrote to memory of 1728	1668	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 1668 wrote to memory of 1728	1668	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 1668 wrote to memory of 1728	1668	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 1668 wrote to memory of 1728	1668	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe

C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe
"C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe
"C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-2-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/1668-3-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/1668-5-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1668-6-0x0000000000530000-0x0000000000553000-memory.dmp

Filesize
140KB

Download
memory/1668-7-0x0000000004B30000-0x0000000004B91000-memory.dmp

Filesize
388KB

Download
memory/1728-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1728-9-0x000000000041CFF0-mapping.dmp

Download
memory/1728-11-0x0000000000CA0000-0x0000000000FA3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing