formbook | 6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

General

Target

HTK TT600202109300860048866 Payment Proof.pdf.exe
Size

461KB
MD5

f12bf73a1cb81b5ddd8dd6ed66e610f1
SHA1

cb8b0497c95512bf9233823f7d20937424c87207
SHA256

6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33
SHA512

385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Score

10^/10

formbook xloader euzn loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/908-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/908-63-0x000000000041D420-mapping.dmp	xloader
behavioral2/memory/832-72-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader
behavioral2/memory/1316-87-0x000000000041D420-mapping.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JHD0H4187VE = "C:\\Program Files (x86)\\Sxrnhwb\\mfccdd.exe"	rundll32.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

54 832 rundll32.exe
Executes dropped EXE 2 IoCs

Processes:

mfccdd.exemfccdd.exe

pid process

1608 mfccdd.exe
1316 mfccdd.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1880 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
54	832	rundll32.exe

pid	process
1608	mfccdd.exe
1316	mfccdd.exe

pid	process
1880	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.exeHTK TT600202109300860048866 Payment Proof.pdf.exerundll32.exemfccdd.exe

description	pid	process	target process
PID 268 set thread context of 908	268	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 908 set thread context of 1204	908	HTK TT600202109300860048866 Payment Proof.pdf.exe	Explorer.EXE
PID 832 set thread context of 1204	832	rundll32.exe	Explorer.EXE
PID 1608 set thread context of 1316	1608	mfccdd.exe	mfccdd.exe

Drops file in Program Files directory 2 IoCs

Processes:

rundll32.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Sxrnhwb\mfccdd.exe	rundll32.exe
File created	C:\Program Files (x86)\Sxrnhwb\mfccdd.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.exerundll32.exemfccdd.exe

pid	process
908	HTK TT600202109300860048866 Payment Proof.pdf.exe
908	HTK TT600202109300860048866 Payment Proof.pdf.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
1316	mfccdd.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE

pid	process
1204	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.exerundll32.exe

pid	process
908	HTK TT600202109300860048866 Payment Proof.pdf.exe
908	HTK TT600202109300860048866 Payment Proof.pdf.exe
908	HTK TT600202109300860048866 Payment Proof.pdf.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.exerundll32.exemfccdd.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	908	HTK TT600202109300860048866 Payment Proof.pdf.exe
Token: SeDebugPrivilege	832	rundll32.exe
Token: SeDebugPrivilege	1316	mfccdd.exe
Token: SeShutdownPrivilege	1204	Explorer.EXE
Token: SeShutdownPrivilege	1204	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.exeExplorer.EXErundll32.exemfccdd.exe

description	pid	process	target process
PID 268 wrote to memory of 908	268	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 268 wrote to memory of 908	268	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 268 wrote to memory of 908	268	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 268 wrote to memory of 908	268	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 268 wrote to memory of 908	268	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 268 wrote to memory of 908	268	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 268 wrote to memory of 908	268	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 1204 wrote to memory of 832	1204	Explorer.EXE	rundll32.exe
PID 1204 wrote to memory of 832	1204	Explorer.EXE	rundll32.exe
PID 1204 wrote to memory of 832	1204	Explorer.EXE	rundll32.exe
PID 1204 wrote to memory of 832	1204	Explorer.EXE	rundll32.exe
PID 1204 wrote to memory of 832	1204	Explorer.EXE	rundll32.exe
PID 1204 wrote to memory of 832	1204	Explorer.EXE	rundll32.exe
PID 1204 wrote to memory of 832	1204	Explorer.EXE	rundll32.exe
PID 832 wrote to memory of 1880	832	rundll32.exe	cmd.exe
PID 832 wrote to memory of 1880	832	rundll32.exe	cmd.exe
PID 832 wrote to memory of 1880	832	rundll32.exe	cmd.exe
PID 832 wrote to memory of 1880	832	rundll32.exe	cmd.exe
PID 832 wrote to memory of 1132	832	rundll32.exe	Firefox.exe
PID 832 wrote to memory of 1132	832	rundll32.exe	Firefox.exe
PID 832 wrote to memory of 1132	832	rundll32.exe	Firefox.exe
PID 832 wrote to memory of 1132	832	rundll32.exe	Firefox.exe
PID 1204 wrote to memory of 1608	1204	Explorer.EXE	mfccdd.exe
PID 1204 wrote to memory of 1608	1204	Explorer.EXE	mfccdd.exe
PID 1204 wrote to memory of 1608	1204	Explorer.EXE	mfccdd.exe
PID 1204 wrote to memory of 1608	1204	Explorer.EXE	mfccdd.exe
PID 832 wrote to memory of 1132	832	rundll32.exe	Firefox.exe
PID 1608 wrote to memory of 1316	1608	mfccdd.exe	mfccdd.exe
PID 1608 wrote to memory of 1316	1608	mfccdd.exe	mfccdd.exe
PID 1608 wrote to memory of 1316	1608	mfccdd.exe	mfccdd.exe
PID 1608 wrote to memory of 1316	1608	mfccdd.exe	mfccdd.exe
PID 1608 wrote to memory of 1316	1608	mfccdd.exe	mfccdd.exe
PID 1608 wrote to memory of 1316	1608	mfccdd.exe	mfccdd.exe
PID 1608 wrote to memory of 1316	1608	mfccdd.exe	mfccdd.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	rundll32.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:268

C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:832

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
3⤵
- Deletes itself
PID:1880

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1132

C:\Program Files (x86)\Sxrnhwb\mfccdd.exe
"C:\Program Files (x86)\Sxrnhwb\mfccdd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1608

C:\Program Files (x86)\Sxrnhwb\mfccdd.exe
"C:\Program Files (x86)\Sxrnhwb\mfccdd.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Sxrnhwb\mfccdd.exe
MD5
f12bf73a1cb81b5ddd8dd6ed66e610f1

SHA1
cb8b0497c95512bf9233823f7d20937424c87207

SHA256
6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

SHA512
385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Download Submit
C:\Program Files (x86)\Sxrnhwb\mfccdd.exe
MD5
f12bf73a1cb81b5ddd8dd6ed66e610f1

SHA1
cb8b0497c95512bf9233823f7d20937424c87207

SHA256
6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

SHA512
385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Download Submit
C:\Program Files (x86)\Sxrnhwb\mfccdd.exe
MD5
f12bf73a1cb81b5ddd8dd6ed66e610f1

SHA1
cb8b0497c95512bf9233823f7d20937424c87207

SHA256
6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

SHA512
385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Download Submit
memory/268-54-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/268-56-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/268-57-0x00000000002D0000-0x00000000002D7000-memory.dmp

Filesize
28KB

Download
memory/268-58-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/268-59-0x0000000004420000-0x000000000446B000-memory.dmp

Filesize
300KB

Download
memory/832-74-0x0000000000970000-0x0000000000A00000-memory.dmp

Filesize
576KB

Download
memory/832-68-0x0000000000000000-mapping.dmp

Download
memory/832-71-0x0000000000E50000-0x0000000000E5E000-memory.dmp

Filesize
56KB

Download
memory/832-73-0x0000000002260000-0x0000000002563000-memory.dmp

Filesize
3.0MB

Download
memory/832-72-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/908-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-66-0x0000000000330000-0x0000000000341000-memory.dmp

Filesize
68KB

Download
memory/908-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-65-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/908-63-0x000000000041D420-mapping.dmp

Download
memory/1204-75-0x0000000004C50000-0x0000000004D92000-memory.dmp

Filesize
1.3MB

Download
memory/1204-67-0x0000000004820000-0x00000000048D0000-memory.dmp

Filesize
704KB

Download
memory/1316-87-0x000000000041D420-mapping.dmp

Download
memory/1316-89-0x0000000000870000-0x0000000000B73000-memory.dmp

Filesize
3.0MB

Download
memory/1608-76-0x0000000000000000-mapping.dmp

Download
memory/1608-79-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/1608-82-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/1880-70-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads