formbook | b32d120bf6320cf1d2d2223ad2a797eb0c20efceb12bd0655642387452ef3b6e

General

Target

RAQ11986.exe
Size

361KB
MD5

725cb0465119c2d5cc1412e3d555ad04
SHA1

d6623ecd4f819c1597392fe423d41be071a000e1
SHA256

b32d120bf6320cf1d2d2223ad2a797eb0c20efceb12bd0655642387452ef3b6e
SHA512

4b9c8d288433d18be705099752bff38020c99b5496ce66e0a2cfeb99195840c9911f9b871620abb6219a873f05c2efb4b11507db6be386ba0639e545e3d53ae6

Score

10^/10

formbook xloader loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.wissinkadams.com/iae2/

Decoy

mainstreetswimschool.com

nhadat9chu.com

guidedcommercialloan.com

quandd.site

smittysfrontlinecarriers.com

hmas-vibrant.com

pakunok.net

jiffihosting.com

shopping-container.com

quartiercreole.net

weebflix.com

gringomexico.com

whathappensnextin6minutes.com

patchealth.com

exclusivelymarissa.com

my-glp.com

trgtbk.com

sagefemmecaluire.com

fetaldiagnosislaboratorios.com

aniversariocom-presente12.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral2/memory/4756-5-0x0000000004DA0000-0x0000000004DF9000-memory.dmp	beds_protector

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3236-12-0x000000000041D0D0-mapping.dmp	xloader
behavioral2/memory/3236-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/704-21-0x0000000002AA0000-0x0000000002AC9000-memory.dmp	xloader

Suspicious use of SetThreadContext 4 IoCs

Processes:

RAQ11986.exeRAQ11986.execontrol.exe

description	pid	process	target process
PID 4756 set thread context of 3236	4756	RAQ11986.exe	RAQ11986.exe
PID 3236 set thread context of 3012	3236	RAQ11986.exe	Explorer.EXE
PID 3236 set thread context of 3012	3236	RAQ11986.exe	Explorer.EXE
PID 704 set thread context of 3012	704	control.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RAQ11986.exeRAQ11986.execontrol.exe

pid	process
4756	RAQ11986.exe
4756	RAQ11986.exe
4756	RAQ11986.exe
4756	RAQ11986.exe
3236	RAQ11986.exe
3236	RAQ11986.exe
3236	RAQ11986.exe
3236	RAQ11986.exe
3236	RAQ11986.exe
3236	RAQ11986.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe
704	control.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

RAQ11986.execontrol.exe

pid process

3236 RAQ11986.exe
3236 RAQ11986.exe
3236 RAQ11986.exe
3236 RAQ11986.exe
704 control.exe
704 control.exe

pid	process
3236	RAQ11986.exe
3236	RAQ11986.exe
3236	RAQ11986.exe
3236	RAQ11986.exe
704	control.exe
704	control.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

RAQ11986.exeRAQ11986.execontrol.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4756	RAQ11986.exe
Token: SeDebugPrivilege	3236	RAQ11986.exe
Token: SeDebugPrivilege	704	control.exe
Token: SeShutdownPrivilege	3012	Explorer.EXE
Token: SeCreatePagefilePrivilege	3012	Explorer.EXE
Token: SeShutdownPrivilege	3012	Explorer.EXE
Token: SeCreatePagefilePrivilege	3012	Explorer.EXE
Token: SeShutdownPrivilege	3012	Explorer.EXE
Token: SeCreatePagefilePrivilege	3012	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

RAQ11986.exeRAQ11986.execontrol.exe

description	pid	process	target process
PID 4756 wrote to memory of 4264	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 4264	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 4264	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 4376	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 4376	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 4376	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 3236	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 3236	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 3236	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 3236	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 3236	4756	RAQ11986.exe	RAQ11986.exe
PID 4756 wrote to memory of 3236	4756	RAQ11986.exe	RAQ11986.exe
PID 3236 wrote to memory of 704	3236	RAQ11986.exe	control.exe
PID 3236 wrote to memory of 704	3236	RAQ11986.exe	control.exe
PID 3236 wrote to memory of 704	3236	RAQ11986.exe	control.exe
PID 704 wrote to memory of 1128	704	control.exe	cmd.exe
PID 704 wrote to memory of 1128	704	control.exe	cmd.exe
PID 704 wrote to memory of 1128	704	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe
"C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756

C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe
"C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe"
3⤵
PID:4264

C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe
"C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe"
5⤵
PID:1128

C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe
"C:\Users\Admin\AppData\Local\Temp\RAQ11986.exe"
3⤵
PID:4376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/704-24-0x0000000004270000-0x00000000042FF000-memory.dmp

Filesize
572KB

Download
memory/704-23-0x0000000004510000-0x0000000004830000-memory.dmp

Filesize
3.1MB

Download
memory/704-20-0x0000000000230000-0x0000000000250000-memory.dmp

Filesize
128KB

Download
memory/704-21-0x0000000002AA0000-0x0000000002AC9000-memory.dmp

Filesize
164KB

Download
memory/704-19-0x0000000000000000-mapping.dmp

Download
memory/1128-22-0x0000000000000000-mapping.dmp

Download
memory/3012-16-0x00000000058F0000-0x0000000005A96000-memory.dmp

Filesize
1.6MB

Download
memory/3012-25-0x00000000030E0000-0x0000000003179000-memory.dmp

Filesize
612KB

Download
memory/3012-18-0x00000000065E0000-0x00000000066F9000-memory.dmp

Filesize
1.1MB

Download
memory/3236-14-0x00000000010B0000-0x00000000013D0000-memory.dmp

Filesize
3.1MB

Download
memory/3236-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3236-15-0x00000000007F0000-0x0000000000800000-memory.dmp

Filesize
64KB

Download
memory/3236-17-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/3236-12-0x000000000041D0D0-mapping.dmp

Download
memory/4756-2-0x0000000073150000-0x000000007383E000-memory.dmp

Filesize
6.9MB

Download
memory/4756-9-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/4756-10-0x0000000004E20000-0x0000000004E2F000-memory.dmp

Filesize
60KB

Download
memory/4756-8-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/4756-7-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/4756-6-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/4756-5-0x0000000004DA0000-0x0000000004DF9000-memory.dmp

Filesize
356KB

Download
memory/4756-3-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads