formbook | 8fe13da45a5732ae42c27687b9cf9105a3f2028857729bdfbe3ae31514a6b298

General

Target

b75247013200d602f98dc3801d2bde2f.exe
Size

931KB
MD5

b75247013200d602f98dc3801d2bde2f
SHA1

3327c5cd3ecd636b72c335166fe709b955a32285
SHA256

8fe13da45a5732ae42c27687b9cf9105a3f2028857729bdfbe3ae31514a6b298
SHA512

aa0b977c81b0e97433e61e21cc1e13cbc8821b5ff4d0b3e7554519051139dc661b4c9c0d8e99a6ff4148968d9f04653c85b411944f42fec29bdd4c70228229f9

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.learnhour.net/eaud/

Decoy

modshiro.com

mademarketingoss.com

austinjourls.info

wayupteam.com

crossingfinger.com

interseptors.com

gigashit.com

livetigo.com

halamankuningindonesia.com

windhammills.com

aylinahmet.com

mbacexonan.website

shopboxbarcelona.com

youyeslive.com

coonlinesportsbooks.com

guorunme.com

putlocker2.site

pencueaidnetwork.com

likevector.com

vulcanudachi-proclub.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1692-8-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1692-9-0x000000000041D030-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

b75247013200d602f98dc3801d2bde2f.exe

description pid process target process

PID 800 set thread context of 1692 800 b75247013200d602f98dc3801d2bde2f.exe b75247013200d602f98dc3801d2bde2f.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b75247013200d602f98dc3801d2bde2f.exe

pid process

1692 b75247013200d602f98dc3801d2bde2f.exe

description	pid	process	target process
PID 800 set thread context of 1692	800	b75247013200d602f98dc3801d2bde2f.exe	b75247013200d602f98dc3801d2bde2f.exe

pid	process
1692	b75247013200d602f98dc3801d2bde2f.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b75247013200d602f98dc3801d2bde2f.exe

description	pid	process	target process
PID 800 wrote to memory of 1692	800	b75247013200d602f98dc3801d2bde2f.exe	b75247013200d602f98dc3801d2bde2f.exe
PID 800 wrote to memory of 1692	800	b75247013200d602f98dc3801d2bde2f.exe	b75247013200d602f98dc3801d2bde2f.exe
PID 800 wrote to memory of 1692	800	b75247013200d602f98dc3801d2bde2f.exe	b75247013200d602f98dc3801d2bde2f.exe
PID 800 wrote to memory of 1692	800	b75247013200d602f98dc3801d2bde2f.exe	b75247013200d602f98dc3801d2bde2f.exe
PID 800 wrote to memory of 1692	800	b75247013200d602f98dc3801d2bde2f.exe	b75247013200d602f98dc3801d2bde2f.exe
PID 800 wrote to memory of 1692	800	b75247013200d602f98dc3801d2bde2f.exe	b75247013200d602f98dc3801d2bde2f.exe
PID 800 wrote to memory of 1692	800	b75247013200d602f98dc3801d2bde2f.exe	b75247013200d602f98dc3801d2bde2f.exe

C:\Users\Admin\AppData\Local\Temp\b75247013200d602f98dc3801d2bde2f.exe
"C:\Users\Admin\AppData\Local\Temp\b75247013200d602f98dc3801d2bde2f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\b75247013200d602f98dc3801d2bde2f.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-2-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/800-3-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/800-5-0x0000000001310000-0x0000000001311000-memory.dmp

Filesize
4KB

Download
memory/800-6-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/800-7-0x0000000000E50000-0x0000000000E98000-memory.dmp

Filesize
288KB

Download
memory/1692-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1692-9-0x000000000041D030-mapping.dmp

Download
memory/1692-11-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing