formbook | 1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf

General

Target

Unpaid invoice.exe
Size

450KB
MD5

98d2d5ac3bd493d77f0a7300a43d045b
SHA1

7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7
SHA256

1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
SHA512

32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3

Score

10^/10

formbook xloader b2c0 loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1604-55-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1604-56-0x000000000041D4C0-mapping.dmp	xloader
behavioral1/memory/520-63-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader
behavioral1/memory/1748-76-0x000000000041D4C0-mapping.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wlanext.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wlanext.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\9R0DOPOHN = "C:\\Program Files (x86)\\Flf9l_rn\\helpabc.exe"	wlanext.exe

Executes dropped EXE 2 IoCs

Processes:

helpabc.exehelpabc.exe

pid process

1000 helpabc.exe
1748 helpabc.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1216 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

Unpaid invoice.exehelpabc.exe

pid process

1504 Unpaid invoice.exe
1000 helpabc.exe

pid	process
1000	helpabc.exe
1748	helpabc.exe

pid	process
1216	cmd.exe

pid	process
1504	Unpaid invoice.exe
1000	helpabc.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Unpaid invoice.exeUnpaid invoice.exewlanext.exehelpabc.exe

description	pid	process	target process
PID 1504 set thread context of 1604	1504	Unpaid invoice.exe	Unpaid invoice.exe
PID 1604 set thread context of 1400	1604	Unpaid invoice.exe	Explorer.EXE
PID 520 set thread context of 1400	520	wlanext.exe	Explorer.EXE
PID 1000 set thread context of 1748	1000	helpabc.exe	helpabc.exe

Drops file in Program Files directory 2 IoCs

Processes:

wlanext.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Flf9l_rn\helpabc.exe	wlanext.exe
File created	C:\Program Files (x86)\Flf9l_rn\helpabc.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Program Files (x86)\Flf9l_rn\helpabc.exe	nsis_installer_1
C:\Program Files (x86)\Flf9l_rn\helpabc.exe	nsis_installer_2
C:\Program Files (x86)\Flf9l_rn\helpabc.exe	nsis_installer_1
C:\Program Files (x86)\Flf9l_rn\helpabc.exe	nsis_installer_2
C:\Program Files (x86)\Flf9l_rn\helpabc.exe	nsis_installer_1
C:\Program Files (x86)\Flf9l_rn\helpabc.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

wlanext.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wlanext.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Unpaid invoice.exewlanext.exehelpabc.exe

pid	process
1604	Unpaid invoice.exe
1604	Unpaid invoice.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
1748	helpabc.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe
520	wlanext.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Unpaid invoice.exewlanext.exe

pid process

1604 Unpaid invoice.exe
1604 Unpaid invoice.exe
1604 Unpaid invoice.exe
520 wlanext.exe
520 wlanext.exe
520 wlanext.exe
520 wlanext.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Unpaid invoice.exewlanext.exehelpabc.exe

description pid process

Token: SeDebugPrivilege 1604 Unpaid invoice.exe
Token: SeDebugPrivilege 520 wlanext.exe
Token: SeDebugPrivilege 1748 helpabc.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE

pid	process
1400	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1604	Unpaid invoice.exe
Token: SeDebugPrivilege	520	wlanext.exe
Token: SeDebugPrivilege	1748	helpabc.exe

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

Unpaid invoice.exeExplorer.EXEwlanext.exehelpabc.exe

description	pid	process	target process
PID 1504 wrote to memory of 1604	1504	Unpaid invoice.exe	Unpaid invoice.exe
PID 1504 wrote to memory of 1604	1504	Unpaid invoice.exe	Unpaid invoice.exe
PID 1504 wrote to memory of 1604	1504	Unpaid invoice.exe	Unpaid invoice.exe
PID 1504 wrote to memory of 1604	1504	Unpaid invoice.exe	Unpaid invoice.exe
PID 1504 wrote to memory of 1604	1504	Unpaid invoice.exe	Unpaid invoice.exe
PID 1504 wrote to memory of 1604	1504	Unpaid invoice.exe	Unpaid invoice.exe
PID 1504 wrote to memory of 1604	1504	Unpaid invoice.exe	Unpaid invoice.exe
PID 1400 wrote to memory of 520	1400	Explorer.EXE	wlanext.exe
PID 1400 wrote to memory of 520	1400	Explorer.EXE	wlanext.exe
PID 1400 wrote to memory of 520	1400	Explorer.EXE	wlanext.exe
PID 1400 wrote to memory of 520	1400	Explorer.EXE	wlanext.exe
PID 520 wrote to memory of 1216	520	wlanext.exe	cmd.exe
PID 520 wrote to memory of 1216	520	wlanext.exe	cmd.exe
PID 520 wrote to memory of 1216	520	wlanext.exe	cmd.exe
PID 520 wrote to memory of 1216	520	wlanext.exe	cmd.exe
PID 520 wrote to memory of 1176	520	wlanext.exe	Firefox.exe
PID 520 wrote to memory of 1176	520	wlanext.exe	Firefox.exe
PID 520 wrote to memory of 1176	520	wlanext.exe	Firefox.exe
PID 520 wrote to memory of 1176	520	wlanext.exe	Firefox.exe
PID 1400 wrote to memory of 1000	1400	Explorer.EXE	helpabc.exe
PID 1400 wrote to memory of 1000	1400	Explorer.EXE	helpabc.exe
PID 1400 wrote to memory of 1000	1400	Explorer.EXE	helpabc.exe
PID 1400 wrote to memory of 1000	1400	Explorer.EXE	helpabc.exe
PID 1000 wrote to memory of 1748	1000	helpabc.exe	helpabc.exe
PID 1000 wrote to memory of 1748	1000	helpabc.exe	helpabc.exe
PID 1000 wrote to memory of 1748	1000	helpabc.exe	helpabc.exe
PID 1000 wrote to memory of 1748	1000	helpabc.exe	helpabc.exe
PID 1000 wrote to memory of 1748	1000	helpabc.exe	helpabc.exe
PID 1000 wrote to memory of 1748	1000	helpabc.exe	helpabc.exe
PID 1000 wrote to memory of 1748	1000	helpabc.exe	helpabc.exe
PID 520 wrote to memory of 1176	520	wlanext.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
3⤵
- Deletes itself
PID:1216

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1176

C:\Program Files (x86)\Flf9l_rn\helpabc.exe
"C:\Program Files (x86)\Flf9l_rn\helpabc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1000

C:\Program Files (x86)\Flf9l_rn\helpabc.exe
"C:\Program Files (x86)\Flf9l_rn\helpabc.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Flf9l_rn\helpabc.exe
MD5
98d2d5ac3bd493d77f0a7300a43d045b

SHA1
7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7

SHA256
1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf

SHA512
32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3

Download Submit
C:\Program Files (x86)\Flf9l_rn\helpabc.exe
MD5
98d2d5ac3bd493d77f0a7300a43d045b

SHA1
7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7

SHA256
1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf

SHA512
32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3

Download Submit
C:\Program Files (x86)\Flf9l_rn\helpabc.exe
MD5
98d2d5ac3bd493d77f0a7300a43d045b

SHA1
7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7

SHA256
1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf

SHA512
32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\djr4rhq6jcukl62j
MD5
c8e5581e5646ddac5b28cd6a9159e10f

SHA1
05a495f74a671d368879436d4ed105289af01007

SHA256
67269ca1ea6587aed58a7185f845d141c55cfbffe92115c990ec51b815d6adf3

SHA512
0f6a57e0f28fd694a7cde2a970f5644328027fe92e426bdd94dc6491f411e5f3ce9f9ba1af2fbc0b47af1fcb142420ff4a7c559c9c4a1b9245c8a45db5c0be89

Download Submit
\Users\Admin\AppData\Local\Temp\nsyC811.tmp\gyalquzbu.dll
MD5
a8caa6d267951ad22e835233b5e50c46

SHA1
45c722c5958d99727a95d30eaa3032203d1f4ab2

SHA256
db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76

SHA512
9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7

Download Submit
\Users\Admin\AppData\Local\Temp\nsz9780.tmp\gyalquzbu.dll
MD5
a8caa6d267951ad22e835233b5e50c46

SHA1
45c722c5958d99727a95d30eaa3032203d1f4ab2

SHA256
db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76

SHA512
9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7

Download Submit
memory/520-66-0x0000000001CF0000-0x0000000001D80000-memory.dmp

Filesize
576KB

Download
memory/520-61-0x0000000000000000-mapping.dmp

Download
memory/520-63-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/520-62-0x00000000004A0000-0x00000000004B6000-memory.dmp

Filesize
88KB

Download
memory/520-65-0x0000000001EB0000-0x00000000021B3000-memory.dmp

Filesize
3.0MB

Download
memory/1000-69-0x0000000000000000-mapping.dmp

Download
memory/1216-64-0x0000000000000000-mapping.dmp

Download
memory/1400-67-0x0000000008B10000-0x0000000008C78000-memory.dmp

Filesize
1.4MB

Download
memory/1400-60-0x0000000006A10000-0x0000000006B30000-memory.dmp

Filesize
1.1MB

Download
memory/1504-53-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1604-58-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1604-59-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/1604-56-0x000000000041D4C0-mapping.dmp

Download
memory/1604-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1748-76-0x000000000041D4C0-mapping.dmp

Download
memory/1748-78-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads