formbook | b073ef66058998fc6ee7c61fb6eeaffe28a816f36dda995edcd1a6e893deedd3

General

Target

cc17df44b8e738bbe7614e5b0fbaf229.exe
Size

908KB
MD5

cc17df44b8e738bbe7614e5b0fbaf229
SHA1

0501119c5e52d771b127764f7fffb5f38c6c45b1
SHA256

b073ef66058998fc6ee7c61fb6eeaffe28a816f36dda995edcd1a6e893deedd3
SHA512

d0e61e958740521e2463989037236cd87579ffef430e9eca263c70dbcadc160c44a015b1dd3411c0240374aa6a1cf7b47946b775eebccc004a52c1aad3371bc8

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1308-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/1308-14-0x000000000041CFF0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

cc17df44b8e738bbe7614e5b0fbaf229.exe

description pid process target process

PID 652 set thread context of 1308 652 cc17df44b8e738bbe7614e5b0fbaf229.exe cc17df44b8e738bbe7614e5b0fbaf229.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cc17df44b8e738bbe7614e5b0fbaf229.exe

pid process

1308 cc17df44b8e738bbe7614e5b0fbaf229.exe
1308 cc17df44b8e738bbe7614e5b0fbaf229.exe

description	pid	process	target process
PID 652 set thread context of 1308	652	cc17df44b8e738bbe7614e5b0fbaf229.exe	cc17df44b8e738bbe7614e5b0fbaf229.exe

pid	process
1308	cc17df44b8e738bbe7614e5b0fbaf229.exe
1308	cc17df44b8e738bbe7614e5b0fbaf229.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cc17df44b8e738bbe7614e5b0fbaf229.exe

description	pid	process	target process
PID 652 wrote to memory of 1308	652	cc17df44b8e738bbe7614e5b0fbaf229.exe	cc17df44b8e738bbe7614e5b0fbaf229.exe
PID 652 wrote to memory of 1308	652	cc17df44b8e738bbe7614e5b0fbaf229.exe	cc17df44b8e738bbe7614e5b0fbaf229.exe
PID 652 wrote to memory of 1308	652	cc17df44b8e738bbe7614e5b0fbaf229.exe	cc17df44b8e738bbe7614e5b0fbaf229.exe
PID 652 wrote to memory of 1308	652	cc17df44b8e738bbe7614e5b0fbaf229.exe	cc17df44b8e738bbe7614e5b0fbaf229.exe
PID 652 wrote to memory of 1308	652	cc17df44b8e738bbe7614e5b0fbaf229.exe	cc17df44b8e738bbe7614e5b0fbaf229.exe
PID 652 wrote to memory of 1308	652	cc17df44b8e738bbe7614e5b0fbaf229.exe	cc17df44b8e738bbe7614e5b0fbaf229.exe

C:\Users\Admin\AppData\Local\Temp\cc17df44b8e738bbe7614e5b0fbaf229.exe
"C:\Users\Admin\AppData\Local\Temp\cc17df44b8e738bbe7614e5b0fbaf229.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652

C:\Users\Admin\AppData\Local\Temp\cc17df44b8e738bbe7614e5b0fbaf229.exe
"C:\Users\Admin\AppData\Local\Temp\cc17df44b8e738bbe7614e5b0fbaf229.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/652-3-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/652-5-0x0000000007510000-0x0000000007511000-memory.dmp

Filesize
4KB

Download
memory/652-6-0x0000000007AB0000-0x0000000007AB1000-memory.dmp

Filesize
4KB

Download
memory/652-7-0x00000000075B0000-0x00000000075B1000-memory.dmp

Filesize
4KB

Download
memory/652-8-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/652-9-0x0000000007710000-0x0000000007711000-memory.dmp

Filesize
4KB

Download
memory/652-10-0x00000000077D0000-0x00000000077D1000-memory.dmp

Filesize
4KB

Download
memory/652-11-0x0000000007770000-0x0000000007793000-memory.dmp

Filesize
140KB

Download
memory/652-12-0x00000000081B0000-0x0000000008219000-memory.dmp

Filesize
420KB

Download
memory/1308-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1308-14-0x000000000041CFF0-mapping.dmp

Download
memory/1308-16-0x0000000001460000-0x0000000001780000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing