formbook | a38cbbb16b9dda3d7aebcdcd033a8f5e56f17257c060859a3cdd2e1a8bb27ab9

General

Target

2d6580e78be6580bf89ed5e9e13f14e0.exe
Size

1.4MB
MD5

2d6580e78be6580bf89ed5e9e13f14e0
SHA1

3f5153f7da3338d61164df6944b01a0666396517
SHA256

a38cbbb16b9dda3d7aebcdcd033a8f5e56f17257c060859a3cdd2e1a8bb27ab9
SHA512

c58a9f97990e255afd7b6f5538a95d132e0ad00d204b6f3de32e1d675a45d99397e098fe9515081d13eb9ba3491d8cea294f19c7392563212549fc8a739a37bb

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.inreachpt.com/gqx2/

Decoy

calusaptamiami.com

starlinkwebservices.com

lakeviewbarbershonola.com

oaklandraidersjerseyspop.com

ohiotechreport.com

eligetucafetera.com

tu4343.com

abstract-elearning.com

thebabylashes.com

athleteshive.com

fanninhomesforless.com

sembracna.com

servicesyn.com

bellairechoice.com

tmpaas.com

eyepaa.com

stickerzblvd.com

rentfs.com

nadya-shanab.com

microwgreens.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1088-10-0x000000000041D070-mapping.dmp	xloader
behavioral1/memory/1088-9-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

2d6580e78be6580bf89ed5e9e13f14e0.exe

description pid process target process

PID 1604 set thread context of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe

description	pid	process	target process
PID 1604 set thread context of 1088	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe	2d6580e78be6580bf89ed5e9e13f14e0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2d6580e78be6580bf89ed5e9e13f14e0.exe2d6580e78be6580bf89ed5e9e13f14e0.exe

pid	process
1604	2d6580e78be6580bf89ed5e9e13f14e0.exe
1604	2d6580e78be6580bf89ed5e9e13f14e0.exe
1604	2d6580e78be6580bf89ed5e9e13f14e0.exe
1088	2d6580e78be6580bf89ed5e9e13f14e0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2d6580e78be6580bf89ed5e9e13f14e0.exe

description pid process

Token: SeDebugPrivilege 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe

description	pid	process
Token: SeDebugPrivilege	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2d6580e78be6580bf89ed5e9e13f14e0.exe

description	pid	process	target process
PID 1604 wrote to memory of 1088	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe	2d6580e78be6580bf89ed5e9e13f14e0.exe
PID 1604 wrote to memory of 1088	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe	2d6580e78be6580bf89ed5e9e13f14e0.exe
PID 1604 wrote to memory of 1088	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe	2d6580e78be6580bf89ed5e9e13f14e0.exe
PID 1604 wrote to memory of 1088	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe	2d6580e78be6580bf89ed5e9e13f14e0.exe
PID 1604 wrote to memory of 1088	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe	2d6580e78be6580bf89ed5e9e13f14e0.exe
PID 1604 wrote to memory of 1088	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe	2d6580e78be6580bf89ed5e9e13f14e0.exe
PID 1604 wrote to memory of 1088	1604	2d6580e78be6580bf89ed5e9e13f14e0.exe	2d6580e78be6580bf89ed5e9e13f14e0.exe

C:\Users\Admin\AppData\Local\Temp\2d6580e78be6580bf89ed5e9e13f14e0.exe
"C:\Users\Admin\AppData\Local\Temp\2d6580e78be6580bf89ed5e9e13f14e0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Admin\AppData\Local\Temp\2d6580e78be6580bf89ed5e9e13f14e0.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1088

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-10-0x000000000041D070-mapping.dmp

Download
memory/1088-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1088-12-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/1604-2-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/1604-3-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/1604-5-0x0000000000390000-0x0000000000408000-memory.dmp

Filesize
480KB

Download
memory/1604-6-0x0000000005D50000-0x0000000005D51000-memory.dmp

Filesize
4KB

Download
memory/1604-7-0x0000000000510000-0x000000000051E000-memory.dmp

Filesize
56KB

Download
memory/1604-8-0x0000000005F60000-0x0000000005FB6000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads