formbook | 40acc1cfe1986fee292469e21c175d68bed0502f46af424d0cd8ec42e0ead72d

General

Target

5092bff4eca423c90563e487762966b3.exe
Size

1.1MB
MD5

5092bff4eca423c90563e487762966b3
SHA1

bd929965aa556e4aeca7691d110690e742e68d1c
SHA256

40acc1cfe1986fee292469e21c175d68bed0502f46af424d0cd8ec42e0ead72d
SHA512

f0b8789b0e14252a9592f836d43223d5f920202c3b2c8ed2a3654430036ebd0145e815658d4cdcfddb8969d4a5834d95d53654a6fc7e73a3c71799f9fe1a75f3

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1604-8-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1604-9-0x000000000041CFF0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

5092bff4eca423c90563e487762966b3.exe

description pid process target process

PID 744 set thread context of 1604 744 5092bff4eca423c90563e487762966b3.exe 5092bff4eca423c90563e487762966b3.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5092bff4eca423c90563e487762966b3.exe

pid process

1604 5092bff4eca423c90563e487762966b3.exe

description	pid	process	target process
PID 744 set thread context of 1604	744	5092bff4eca423c90563e487762966b3.exe	5092bff4eca423c90563e487762966b3.exe

pid	process
1604	5092bff4eca423c90563e487762966b3.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5092bff4eca423c90563e487762966b3.exe

description	pid	process	target process
PID 744 wrote to memory of 1604	744	5092bff4eca423c90563e487762966b3.exe	5092bff4eca423c90563e487762966b3.exe
PID 744 wrote to memory of 1604	744	5092bff4eca423c90563e487762966b3.exe	5092bff4eca423c90563e487762966b3.exe
PID 744 wrote to memory of 1604	744	5092bff4eca423c90563e487762966b3.exe	5092bff4eca423c90563e487762966b3.exe
PID 744 wrote to memory of 1604	744	5092bff4eca423c90563e487762966b3.exe	5092bff4eca423c90563e487762966b3.exe
PID 744 wrote to memory of 1604	744	5092bff4eca423c90563e487762966b3.exe	5092bff4eca423c90563e487762966b3.exe
PID 744 wrote to memory of 1604	744	5092bff4eca423c90563e487762966b3.exe	5092bff4eca423c90563e487762966b3.exe
PID 744 wrote to memory of 1604	744	5092bff4eca423c90563e487762966b3.exe	5092bff4eca423c90563e487762966b3.exe

C:\Users\Admin\AppData\Local\Temp\5092bff4eca423c90563e487762966b3.exe
"C:\Users\Admin\AppData\Local\Temp\5092bff4eca423c90563e487762966b3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744

C:\Users\Admin\AppData\Local\Temp\5092bff4eca423c90563e487762966b3.exe
"C:\Users\Admin\AppData\Local\Temp\5092bff4eca423c90563e487762966b3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/744-3-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/744-5-0x0000000000460000-0x0000000000483000-memory.dmp

Filesize
140KB

Download
memory/744-6-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/744-7-0x0000000007960000-0x00000000079C9000-memory.dmp

Filesize
420KB

Download
memory/1604-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1604-9-0x000000000041CFF0-mapping.dmp

Download
memory/1604-11-0x0000000000CB0000-0x0000000000FB3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing