formbook | e6cde5c1b614549613d30761b34c899f4ff69d7e6e3147c21d68bedd64f8fe25

Analysis

max time kernel
149s
max time network
130s
platform
windows7_x64
resource
win7-en-20210920
submitted
04/10/2021, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Angebotsanfrage 86548.exe
Size 365KB
Sample211004-k57jdagbdk
SHA256 e6cde5c1b614549613d30761b34c899f4ff69d7e6e3147c21d68bedd64f8fe25
MD5 5b4f0a86299caa8167044e4c66254290
SHA1 42a66629f75716d56790a610c404294e288224b1
SHA512 3fecdc807f1b49a94794f5c37883df9d8fefafa63c94fe8e6fb3156cc136a1f5b50e601e0f2cd2339cf1830a31b2bb7eab25f281971006d4609fee2190755646
MD5 SHA1 SHA512

Score

10^/10

formbook xloader ou3t loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

ou3t

http://www.ibexgrp.com/ou3t/

Decoy

toteitwithtara.com
scienbunny.com
stlukeumcaustin.com
hypnoticbeauty.net
artisanmakefurniture.com
usaonlinedrs.com
lifeshopdeluxe.com
paddlethepoosa.com
mobilismedlabs.net
iwumenssoccercamps.com
fjgsdgr.com
excelsiorhongkong.online
air.ink
grantopwincup.website
appi50dh.com
link-efootballpoin-konami.com
hukugiyho-life-no1.moe
azevedogroupdev.com
nichemedicalsupport.com
rastipponmkh.com
sto327.com
lingdibao.xyz
329895tyc.com
prefferably.com
hidrauforte.com
sultanepin.com
aj5w2.xyz
furniture-newoffice.com
taru-game.com
silkyskin.one
paperdriver-navi.net
dalixfr.com
northalabamahome.com
braapboxclub.com
mainlandpr.com
thrivinginmotherhood.com
netlnterbank.com
gameprizes.xyz
blue-branch.com
fsmsandbox-drsetup.com
trianglepresentations.com
rnmes.com
shadowwitch.xyz
thehaoi.com
webplayerscandictv2.com
atomizer.xyz
sridhar-rangaswamy.club
willcodesign.com
jsconcreteprosfremont.com
tridimensioned.com
mugsmindset.online
calicorealtygroup.net
beansmagic.com
apan-group.com
latestgift1.com
clearberth.com
bucksplit.com
nftagents.xyz
whukares.com
texasccr.com
santanderburge.com
squadfit.club
gulftradinggambia.com
gratitudeideas.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1440-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1440-57-0x000000000041D420-mapping.dmp	xloader
behavioral1/memory/1552-66-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader
behavioral1/memory/1208-78-0x000000000041D420-mapping.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	colorcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\9REXANEHI = "C:\\Program Files (x86)\\Flpxxv\\vgayz6hzlbp.exe"	colorcpl.exe

Executes dropped EXE 2 IoCs

pid	Process
1544	vgayz6hzlbp.exe
1208	vgayz6hzlbp.exe

Deletes itself 1 IoCs

pid	Process
1264	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1144	Angebotsanfrage 86548.exe
1544	vgayz6hzlbp.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1144 set thread context of 1440	1144	Angebotsanfrage 86548.exe	27
PID 1440 set thread context of 1268	1440	Angebotsanfrage 86548.exe	17
PID 1440 set thread context of 1268	1440	Angebotsanfrage 86548.exe	17
PID 1552 set thread context of 1268	1552	colorcpl.exe	17
PID 1544 set thread context of 1208	1544	vgayz6hzlbp.exe	36

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Flpxxv\vgayz6hzlbp.exe	colorcpl.exe
File created	C:\Program Files (x86)\Flpxxv\vgayz6hzlbp.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000012227-72.dat	nsis_installer_1
behavioral1/files/0x0006000000012227-72.dat	nsis_installer_2
behavioral1/files/0x0006000000012227-74.dat	nsis_installer_1
behavioral1/files/0x0006000000012227-74.dat	nsis_installer_2
behavioral1/files/0x0006000000012227-79.dat	nsis_installer_1
behavioral1/files/0x0006000000012227-79.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	colorcpl.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1440	Angebotsanfrage 86548.exe
1440	Angebotsanfrage 86548.exe
1440	Angebotsanfrage 86548.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe
1208	vgayz6hzlbp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1440	Angebotsanfrage 86548.exe
1440	Angebotsanfrage 86548.exe
1440	Angebotsanfrage 86548.exe
1440	Angebotsanfrage 86548.exe
1552	colorcpl.exe
1552	colorcpl.exe
1552	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	Angebotsanfrage 86548.exe
Token: SeDebugPrivilege	1552	colorcpl.exe
Token: SeDebugPrivilege	1208	vgayz6hzlbp.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1440	1144	Angebotsanfrage 86548.exe	27
PID 1144 wrote to memory of 1440	1144	Angebotsanfrage 86548.exe	27
PID 1144 wrote to memory of 1440	1144	Angebotsanfrage 86548.exe	27
PID 1144 wrote to memory of 1440	1144	Angebotsanfrage 86548.exe	27
PID 1144 wrote to memory of 1440	1144	Angebotsanfrage 86548.exe	27
PID 1144 wrote to memory of 1440	1144	Angebotsanfrage 86548.exe	27
PID 1144 wrote to memory of 1440	1144	Angebotsanfrage 86548.exe	27
PID 1440 wrote to memory of 1552	1440	Angebotsanfrage 86548.exe	28
PID 1440 wrote to memory of 1552	1440	Angebotsanfrage 86548.exe	28
PID 1440 wrote to memory of 1552	1440	Angebotsanfrage 86548.exe	28
PID 1440 wrote to memory of 1552	1440	Angebotsanfrage 86548.exe	28
PID 1552 wrote to memory of 1264	1552	colorcpl.exe	29
PID 1552 wrote to memory of 1264	1552	colorcpl.exe	29
PID 1552 wrote to memory of 1264	1552	colorcpl.exe	29
PID 1552 wrote to memory of 1264	1552	colorcpl.exe	29
PID 1552 wrote to memory of 1192	1552	colorcpl.exe	34
PID 1552 wrote to memory of 1192	1552	colorcpl.exe	34
PID 1552 wrote to memory of 1192	1552	colorcpl.exe	34
PID 1552 wrote to memory of 1192	1552	colorcpl.exe	34
PID 1268 wrote to memory of 1544	1268	Explorer.EXE	35
PID 1268 wrote to memory of 1544	1268	Explorer.EXE	35
PID 1268 wrote to memory of 1544	1268	Explorer.EXE	35
PID 1268 wrote to memory of 1544	1268	Explorer.EXE	35
PID 1544 wrote to memory of 1208	1544	vgayz6hzlbp.exe	36
PID 1544 wrote to memory of 1208	1544	vgayz6hzlbp.exe	36
PID 1544 wrote to memory of 1208	1544	vgayz6hzlbp.exe	36
PID 1544 wrote to memory of 1208	1544	vgayz6hzlbp.exe	36
PID 1544 wrote to memory of 1208	1544	vgayz6hzlbp.exe	36
PID 1544 wrote to memory of 1208	1544	vgayz6hzlbp.exe	36
PID 1544 wrote to memory of 1208	1544	vgayz6hzlbp.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\Angebotsanfrage 86548.exe
  "C:\Users\Admin\AppData\Local\Temp\Angebotsanfrage 86548.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\Angebotsanfrage 86548.exe
    "C:\Users\Admin\AppData\Local\Temp\Angebotsanfrage 86548.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      4⤵
      Adds policy Run key to start application
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\Angebotsanfrage 86548.exe"
        5⤵
        Deletes itself
        
        PID:1264
    - - C:\Program Files\Mozilla Firefox\Firefox.exe
        
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        5⤵
        
        PID:1192
- C:\Program Files (x86)\Flpxxv\vgayz6hzlbp.exe
  "C:\Program Files (x86)\Flpxxv\vgayz6hzlbp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Program Files (x86)\Flpxxv\vgayz6hzlbp.exe
    "C:\Program Files (x86)\Flpxxv\vgayz6hzlbp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Download

memory/1208-80-0x00000000006F0000-0x00000000009F3000-memory.dmp

Download

memory/1268-60-0x0000000004E70000-0x0000000004F7D000-memory.dmp

Download

memory/1268-70-0x0000000008F00000-0x0000000009087000-memory.dmp

Download

memory/1268-62-0x00000000067F0000-0x00000000068E7000-memory.dmp

Download

memory/1440-61-0x00000000003A0000-0x00000000003B1000-memory.dmp

Download

memory/1440-56-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1440-59-0x0000000000350000-0x0000000000361000-memory.dmp

Download

memory/1440-58-0x0000000000730000-0x0000000000A33000-memory.dmp

Download

memory/1552-65-0x00000000003F0000-0x0000000000408000-memory.dmp

Download

memory/1552-69-0x0000000001DF0000-0x0000000001E80000-memory.dmp

Download

memory/1552-68-0x00000000020C0000-0x00000000023C3000-memory.dmp

Download

memory/1552-66-0x0000000000080000-0x00000000000A9000-memory.dmp

Download