formbook | 750292519a4b694e981556bdaec9c5b568ac54f1b9cb52fc1f740cd45b2748ec

General

Target

d4ecd2bd3d00a12dffcf55e006eb7b24.exe
Size

1.0MB
MD5

d4ecd2bd3d00a12dffcf55e006eb7b24
SHA1

99b1322240a29fc6497493c903d179c55676c613
SHA256

750292519a4b694e981556bdaec9c5b568ac54f1b9cb52fc1f740cd45b2748ec
SHA512

31e79736b401f0434f1c71d7694e28989fb5881ad25673abe4893ae1d116a35e5316471d4fc6f96a4f8cd2b23075b3e437139c8e538e3849d8afafc9199ab546

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/580-15-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/580-16-0x000000000041CFF0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

d4ecd2bd3d00a12dffcf55e006eb7b24.exe

description pid process target process

PID 4808 set thread context of 580 4808 d4ecd2bd3d00a12dffcf55e006eb7b24.exe d4ecd2bd3d00a12dffcf55e006eb7b24.exe

description	pid	process	target process
PID 4808 set thread context of 580	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

d4ecd2bd3d00a12dffcf55e006eb7b24.exed4ecd2bd3d00a12dffcf55e006eb7b24.exe

pid	process
4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
580	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
580	d4ecd2bd3d00a12dffcf55e006eb7b24.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d4ecd2bd3d00a12dffcf55e006eb7b24.exe

description pid process

Token: SeDebugPrivilege 4808 d4ecd2bd3d00a12dffcf55e006eb7b24.exe

description	pid	process
Token: SeDebugPrivilege	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

d4ecd2bd3d00a12dffcf55e006eb7b24.exe

description	pid	process	target process
PID 4808 wrote to memory of 532	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 532	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 532	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 584	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 584	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 584	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 580	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 580	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 580	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 580	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 580	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe
PID 4808 wrote to memory of 580	4808	d4ecd2bd3d00a12dffcf55e006eb7b24.exe	d4ecd2bd3d00a12dffcf55e006eb7b24.exe

C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe
"C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808

C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe
"C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe"
2⤵
PID:532

C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe
"C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe"
2⤵
PID:584

C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe
"C:\Users\Admin\AppData\Local\Temp\d4ecd2bd3d00a12dffcf55e006eb7b24.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:580

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/580-18-0x0000000001A50000-0x0000000001D70000-memory.dmp

Filesize
3.1MB

Download
memory/580-16-0x000000000041CFF0-mapping.dmp

Download
memory/4808-9-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Filesize
4KB

Download
memory/4808-7-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/4808-8-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/4808-2-0x00000000739D0000-0x00000000740BE000-memory.dmp

Filesize
6.9MB

Download
memory/4808-10-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/4808-11-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

Filesize
4KB

Download
memory/4808-12-0x0000000005E10000-0x0000000005E33000-memory.dmp

Filesize
140KB

Download
memory/4808-13-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/4808-14-0x0000000006450000-0x00000000064B1000-memory.dmp

Filesize
388KB

Download
memory/4808-6-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/4808-5-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/4808-3-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads