formbook | 4852c82f847938224365300b4fa89e8b3921e3b9d37f2c2b75605184f81ea9d2

General

Target

68249e5a459f6b16aa2aec9ea67cf482.exe
Size

1.4MB
MD5

68249e5a459f6b16aa2aec9ea67cf482
SHA1

0e5b7ebda23ef4de9f8fa496587f015e65d6a8b1
SHA256

4852c82f847938224365300b4fa89e8b3921e3b9d37f2c2b75605184f81ea9d2
SHA512

15d6648a2eaba275377da7b33e7450d6808432a3ff822cca87027c80c59f745fbef91393b6f8094936a981c19eded26386ab675660f6fd04bf2201e4dfa28369

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.classifoods.com/oean/

Decoy

keboate.club

whitehatiq.com

loimtech.com

icaroagencia.com

snigglez.com

noreservationsxpress.com

villacascabel.com

5037adairway.com

growingequity.fund

stafffully.com

bingent.info

tmssaleguarantee.com

neonatalfeedrates.com

george-beauty.com

oraghallaighjourney.net

zunutrition.com

sylkysmooveentertainment.com

ddmns6tzey2d.com

dvcstay.com

304shaughnessygreen.info

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1728-9-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1728-10-0x000000000041CFE0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

68249e5a459f6b16aa2aec9ea67cf482.exe

description pid process target process

PID 292 set thread context of 1728 292 68249e5a459f6b16aa2aec9ea67cf482.exe 68249e5a459f6b16aa2aec9ea67cf482.exe

description	pid	process	target process
PID 292 set thread context of 1728	292	68249e5a459f6b16aa2aec9ea67cf482.exe	68249e5a459f6b16aa2aec9ea67cf482.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

68249e5a459f6b16aa2aec9ea67cf482.exe68249e5a459f6b16aa2aec9ea67cf482.exe

pid	process
292	68249e5a459f6b16aa2aec9ea67cf482.exe
292	68249e5a459f6b16aa2aec9ea67cf482.exe
292	68249e5a459f6b16aa2aec9ea67cf482.exe
1728	68249e5a459f6b16aa2aec9ea67cf482.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

68249e5a459f6b16aa2aec9ea67cf482.exe

description pid process

Token: SeDebugPrivilege 292 68249e5a459f6b16aa2aec9ea67cf482.exe

description	pid	process
Token: SeDebugPrivilege	292	68249e5a459f6b16aa2aec9ea67cf482.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

68249e5a459f6b16aa2aec9ea67cf482.exe

description	pid	process	target process
PID 292 wrote to memory of 1728	292	68249e5a459f6b16aa2aec9ea67cf482.exe	68249e5a459f6b16aa2aec9ea67cf482.exe
PID 292 wrote to memory of 1728	292	68249e5a459f6b16aa2aec9ea67cf482.exe	68249e5a459f6b16aa2aec9ea67cf482.exe
PID 292 wrote to memory of 1728	292	68249e5a459f6b16aa2aec9ea67cf482.exe	68249e5a459f6b16aa2aec9ea67cf482.exe
PID 292 wrote to memory of 1728	292	68249e5a459f6b16aa2aec9ea67cf482.exe	68249e5a459f6b16aa2aec9ea67cf482.exe
PID 292 wrote to memory of 1728	292	68249e5a459f6b16aa2aec9ea67cf482.exe	68249e5a459f6b16aa2aec9ea67cf482.exe
PID 292 wrote to memory of 1728	292	68249e5a459f6b16aa2aec9ea67cf482.exe	68249e5a459f6b16aa2aec9ea67cf482.exe
PID 292 wrote to memory of 1728	292	68249e5a459f6b16aa2aec9ea67cf482.exe	68249e5a459f6b16aa2aec9ea67cf482.exe

C:\Users\Admin\AppData\Local\Temp\68249e5a459f6b16aa2aec9ea67cf482.exe
"C:\Users\Admin\AppData\Local\Temp\68249e5a459f6b16aa2aec9ea67cf482.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292

C:\Users\Admin\AppData\Local\Temp\68249e5a459f6b16aa2aec9ea67cf482.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/292-3-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/292-5-0x0000000000590000-0x000000000060F000-memory.dmp

Filesize
508KB

Download
memory/292-6-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/292-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/292-8-0x0000000000AF0000-0x0000000000B37000-memory.dmp

Filesize
284KB

Download
memory/1728-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1728-10-0x000000000041CFE0-mapping.dmp

Download
memory/1728-12-0x0000000000D10000-0x0000000001013000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads