formbook | 7d47ed47853921d8afd5b66c6305421eb80b582d6e47706602d52ee367496cc1

General

Target

e09bd175e140134c2d836a8c422bb3eb.exe
Size

1.0MB
MD5

e09bd175e140134c2d836a8c422bb3eb
SHA1

a601aaaf82eb6cf0263152f6ad97a2b810924733
SHA256

7d47ed47853921d8afd5b66c6305421eb80b582d6e47706602d52ee367496cc1
SHA512

bda9f748a764db3e738e9026f364566f0dfb5e2eb34b63a52438fb021b0843c51bb95ca8196149bf4d40d6a78e90d7ff55d0c536b998625cd7cc0ddacd701fcf

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4040-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4040-13-0x000000000041D070-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

e09bd175e140134c2d836a8c422bb3eb.exe

description pid process target process

PID 580 set thread context of 4040 580 e09bd175e140134c2d836a8c422bb3eb.exe e09bd175e140134c2d836a8c422bb3eb.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e09bd175e140134c2d836a8c422bb3eb.exe

pid process

4040 e09bd175e140134c2d836a8c422bb3eb.exe
4040 e09bd175e140134c2d836a8c422bb3eb.exe

description	pid	process	target process
PID 580 set thread context of 4040	580	e09bd175e140134c2d836a8c422bb3eb.exe	e09bd175e140134c2d836a8c422bb3eb.exe

pid	process
4040	e09bd175e140134c2d836a8c422bb3eb.exe
4040	e09bd175e140134c2d836a8c422bb3eb.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e09bd175e140134c2d836a8c422bb3eb.exe

description	pid	process	target process
PID 580 wrote to memory of 4040	580	e09bd175e140134c2d836a8c422bb3eb.exe	e09bd175e140134c2d836a8c422bb3eb.exe
PID 580 wrote to memory of 4040	580	e09bd175e140134c2d836a8c422bb3eb.exe	e09bd175e140134c2d836a8c422bb3eb.exe
PID 580 wrote to memory of 4040	580	e09bd175e140134c2d836a8c422bb3eb.exe	e09bd175e140134c2d836a8c422bb3eb.exe
PID 580 wrote to memory of 4040	580	e09bd175e140134c2d836a8c422bb3eb.exe	e09bd175e140134c2d836a8c422bb3eb.exe
PID 580 wrote to memory of 4040	580	e09bd175e140134c2d836a8c422bb3eb.exe	e09bd175e140134c2d836a8c422bb3eb.exe
PID 580 wrote to memory of 4040	580	e09bd175e140134c2d836a8c422bb3eb.exe	e09bd175e140134c2d836a8c422bb3eb.exe

C:\Users\Admin\AppData\Local\Temp\e09bd175e140134c2d836a8c422bb3eb.exe
"C:\Users\Admin\AppData\Local\Temp\e09bd175e140134c2d836a8c422bb3eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\e09bd175e140134c2d836a8c422bb3eb.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/580-3-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/580-5-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/580-6-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/580-7-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/580-8-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/580-9-0x0000000005020000-0x000000000502E000-memory.dmp

Filesize
56KB

Download
memory/580-10-0x0000000007420000-0x00000000074A3000-memory.dmp

Filesize
524KB

Download
memory/580-11-0x0000000007550000-0x0000000007551000-memory.dmp

Filesize
4KB

Download
memory/4040-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4040-13-0x000000000041D070-mapping.dmp

Download
memory/4040-15-0x00000000010A0000-0x00000000013C0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing