formbook | 3f761fad9b260d06c4b062814b5ea84a196ec7add1c942748f8651e3c0c8d732

General

Target

215fae8dcce9cd4d49b039770e17e418.exe
Size

1.0MB
MD5

215fae8dcce9cd4d49b039770e17e418
SHA1

9d656901f84e9e31c58e507dbd9d7163d7f08d3b
SHA256

3f761fad9b260d06c4b062814b5ea84a196ec7add1c942748f8651e3c0c8d732
SHA512

e7895cb87dd9792c8ca1be5ae331c0e443c9ecb01b684b8bed03d8c5043c362bc73044e5fc48880107fe257c7d34ad82c57750b517a8411693c721433c6761ec

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1672-8-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1672-9-0x000000000041D070-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

215fae8dcce9cd4d49b039770e17e418.exe

description pid process target process

PID 1108 set thread context of 1672 1108 215fae8dcce9cd4d49b039770e17e418.exe 215fae8dcce9cd4d49b039770e17e418.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

215fae8dcce9cd4d49b039770e17e418.exe

pid process

1672 215fae8dcce9cd4d49b039770e17e418.exe

description	pid	process	target process
PID 1108 set thread context of 1672	1108	215fae8dcce9cd4d49b039770e17e418.exe	215fae8dcce9cd4d49b039770e17e418.exe

pid	process
1672	215fae8dcce9cd4d49b039770e17e418.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

215fae8dcce9cd4d49b039770e17e418.exe

description	pid	process	target process
PID 1108 wrote to memory of 1672	1108	215fae8dcce9cd4d49b039770e17e418.exe	215fae8dcce9cd4d49b039770e17e418.exe
PID 1108 wrote to memory of 1672	1108	215fae8dcce9cd4d49b039770e17e418.exe	215fae8dcce9cd4d49b039770e17e418.exe
PID 1108 wrote to memory of 1672	1108	215fae8dcce9cd4d49b039770e17e418.exe	215fae8dcce9cd4d49b039770e17e418.exe
PID 1108 wrote to memory of 1672	1108	215fae8dcce9cd4d49b039770e17e418.exe	215fae8dcce9cd4d49b039770e17e418.exe
PID 1108 wrote to memory of 1672	1108	215fae8dcce9cd4d49b039770e17e418.exe	215fae8dcce9cd4d49b039770e17e418.exe
PID 1108 wrote to memory of 1672	1108	215fae8dcce9cd4d49b039770e17e418.exe	215fae8dcce9cd4d49b039770e17e418.exe
PID 1108 wrote to memory of 1672	1108	215fae8dcce9cd4d49b039770e17e418.exe	215fae8dcce9cd4d49b039770e17e418.exe

C:\Users\Admin\AppData\Local\Temp\215fae8dcce9cd4d49b039770e17e418.exe
"C:\Users\Admin\AppData\Local\Temp\215fae8dcce9cd4d49b039770e17e418.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1108

C:\Users\Admin\AppData\Local\Temp\215fae8dcce9cd4d49b039770e17e418.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1108-3-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/1108-5-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/1108-6-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/1108-7-0x00000000056A0000-0x0000000005724000-memory.dmp

Filesize
528KB

Download
memory/1672-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1672-9-0x000000000041D070-mapping.dmp

Download
memory/1672-11-0x0000000000A60000-0x0000000000D63000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing