formbook | c73732f1e8d7aff13f1c0ef733d9d4734ad81b12f27b414f0412204eb3373c71

General

Target

bcc528aa9392adaf0ad84a8c70a5c07d.exe
Size

1.0MB
MD5

bcc528aa9392adaf0ad84a8c70a5c07d
SHA1

33a17b53cb865dc6e8cfaf3e37242ed038bf82ba
SHA256

c73732f1e8d7aff13f1c0ef733d9d4734ad81b12f27b414f0412204eb3373c71
SHA512

ade19bf7311acef78dcf3cc79f6a79f7d0e2b962913f63d1476e370fb4f363ce83dcb55df1bbc0f6b60a33a8ab654efb117cebcf1a24602a81950502ccc7b5a3

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/584-13-0x000000000041D070-mapping.dmp	xloader
behavioral2/memory/584-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

bcc528aa9392adaf0ad84a8c70a5c07d.exe

description pid process target process

PID 4768 set thread context of 584 4768 bcc528aa9392adaf0ad84a8c70a5c07d.exe bcc528aa9392adaf0ad84a8c70a5c07d.exe

description	pid	process	target process
PID 4768 set thread context of 584	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

bcc528aa9392adaf0ad84a8c70a5c07d.exebcc528aa9392adaf0ad84a8c70a5c07d.exe

pid	process
4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe
4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe
4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe
4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe
584	bcc528aa9392adaf0ad84a8c70a5c07d.exe
584	bcc528aa9392adaf0ad84a8c70a5c07d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bcc528aa9392adaf0ad84a8c70a5c07d.exe

description pid process

Token: SeDebugPrivilege 4768 bcc528aa9392adaf0ad84a8c70a5c07d.exe

description	pid	process
Token: SeDebugPrivilege	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

bcc528aa9392adaf0ad84a8c70a5c07d.exe

description	pid	process	target process
PID 4768 wrote to memory of 3324	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 3324	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 3324	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 520	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 520	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 520	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 584	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 584	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 584	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 584	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 584	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe
PID 4768 wrote to memory of 584	4768	bcc528aa9392adaf0ad84a8c70a5c07d.exe	bcc528aa9392adaf0ad84a8c70a5c07d.exe

C:\Users\Admin\AppData\Local\Temp\bcc528aa9392adaf0ad84a8c70a5c07d.exe
"C:\Users\Admin\AppData\Local\Temp\bcc528aa9392adaf0ad84a8c70a5c07d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768

C:\Users\Admin\AppData\Local\Temp\bcc528aa9392adaf0ad84a8c70a5c07d.exe
"{path}"
2⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\bcc528aa9392adaf0ad84a8c70a5c07d.exe
"{path}"
2⤵
PID:520

C:\Users\Admin\AppData\Local\Temp\bcc528aa9392adaf0ad84a8c70a5c07d.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:584

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-13-0x000000000041D070-mapping.dmp

Download
memory/584-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/584-15-0x0000000001040000-0x0000000001360000-memory.dmp

Filesize
3.1MB

Download
memory/4768-2-0x0000000073150000-0x000000007383E000-memory.dmp

Filesize
6.9MB

Download
memory/4768-3-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/4768-5-0x0000000005C20000-0x0000000005C21000-memory.dmp

Filesize
4KB

Download
memory/4768-6-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/4768-7-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/4768-8-0x00000000058B0000-0x00000000058BE000-memory.dmp

Filesize
56KB

Download
memory/4768-9-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/4768-10-0x0000000007B60000-0x0000000007BE3000-memory.dmp

Filesize
524KB

Download
memory/4768-11-0x0000000007C90000-0x0000000007C91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads