formbook | 2c9c53afeadf78570137cbee063eb4446a2f2086d516b348199ed4500434c126

General

Target

Order-8011964-pdf.exe
Size

246KB
MD5

e15ae6b598e9b227a07a09056570afd6
SHA1

46b5a6c316570f75be5f9732ece769547d431e39
SHA256

2c9c53afeadf78570137cbee063eb4446a2f2086d516b348199ed4500434c126
SHA512

9648aaae24b7384a12b3c165591c781c375cec2af31afa60002060d9ba81e0f4d616d50ac1e10dedd6d7c363a56ccdceb29598aac517d7dd4341b24256b93ad1

Score

10^/10

formbook xloader uar3 loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uar3

Decoy

sgadvocats.com

mjscannabus.com

hilldaley.com

ksdollhouse.com

hotgiftboutique.com

purebloodsmeet.com

relaunched.info

cap-glove.com

productcollection.store

fulikyy.xyz

remoteaviationjobs.com

bestcleancrystal.com

virtualorganizationpartner.com

bookgocar.com

hattuafhv.quest

makonigroup.com

officecom-myaccount.com

malgorzata-lac.com

e-learningeducators.com

hygilaur.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2036-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/268-62-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

NAPSTAT.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	NAPSTAT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LRWT8TJ0 = "C:\\Program Files (x86)\\Svzg4qd\\useruvzxkzix.exe"	NAPSTAT.EXE

Executes dropped EXE 2 IoCs

Processes:

useruvzxkzix.exeuseruvzxkzix.exe

pid process

1936 useruvzxkzix.exe
1196 useruvzxkzix.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1372 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

Order-8011964-pdf.exeuseruvzxkzix.exe

pid process

812 Order-8011964-pdf.exe
1936 useruvzxkzix.exe

pid	process
1936	useruvzxkzix.exe
1196	useruvzxkzix.exe

pid	process
1372	cmd.exe

pid	process
812	Order-8011964-pdf.exe
1936	useruvzxkzix.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Order-8011964-pdf.exeOrder-8011964-pdf.exeNAPSTAT.EXEuseruvzxkzix.exe

description	pid	process	target process
PID 812 set thread context of 2036	812	Order-8011964-pdf.exe	Order-8011964-pdf.exe
PID 2036 set thread context of 1408	2036	Order-8011964-pdf.exe	Explorer.EXE
PID 268 set thread context of 1408	268	NAPSTAT.EXE	Explorer.EXE
PID 1936 set thread context of 1196	1936	useruvzxkzix.exe	useruvzxkzix.exe

Drops file in Program Files directory 2 IoCs

Processes:

NAPSTAT.EXEExplorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe	NAPSTAT.EXE
File created	C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe	nsis_installer_1
C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe	nsis_installer_2
C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe	nsis_installer_1
C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe	nsis_installer_2
C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe	nsis_installer_1
C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

NAPSTAT.EXE

description	ioc	process
Key created	\Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	NAPSTAT.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Order-8011964-pdf.exeNAPSTAT.EXEuseruvzxkzix.exe

pid	process
2036	Order-8011964-pdf.exe
2036	Order-8011964-pdf.exe
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
1196	useruvzxkzix.exe
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE
268	NAPSTAT.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Order-8011964-pdf.exeNAPSTAT.EXE

pid process

2036 Order-8011964-pdf.exe
2036 Order-8011964-pdf.exe
2036 Order-8011964-pdf.exe
268 NAPSTAT.EXE
268 NAPSTAT.EXE
268 NAPSTAT.EXE
268 NAPSTAT.EXE

pid	process
1408	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Order-8011964-pdf.exeNAPSTAT.EXEuseruvzxkzix.exe

description	pid	process
Token: SeDebugPrivilege	2036	Order-8011964-pdf.exe
Token: SeDebugPrivilege	268	NAPSTAT.EXE
Token: SeDebugPrivilege	1196	useruvzxkzix.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
1408 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
1408 Explorer.EXE

pid	process
1408	Explorer.EXE
1408	Explorer.EXE

pid	process
1408	Explorer.EXE
1408	Explorer.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

Order-8011964-pdf.exeExplorer.EXENAPSTAT.EXEuseruvzxkzix.exe

description	pid	process	target process
PID 812 wrote to memory of 2036	812	Order-8011964-pdf.exe	Order-8011964-pdf.exe
PID 812 wrote to memory of 2036	812	Order-8011964-pdf.exe	Order-8011964-pdf.exe
PID 812 wrote to memory of 2036	812	Order-8011964-pdf.exe	Order-8011964-pdf.exe
PID 812 wrote to memory of 2036	812	Order-8011964-pdf.exe	Order-8011964-pdf.exe
PID 812 wrote to memory of 2036	812	Order-8011964-pdf.exe	Order-8011964-pdf.exe
PID 812 wrote to memory of 2036	812	Order-8011964-pdf.exe	Order-8011964-pdf.exe
PID 812 wrote to memory of 2036	812	Order-8011964-pdf.exe	Order-8011964-pdf.exe
PID 1408 wrote to memory of 268	1408	Explorer.EXE	NAPSTAT.EXE
PID 1408 wrote to memory of 268	1408	Explorer.EXE	NAPSTAT.EXE
PID 1408 wrote to memory of 268	1408	Explorer.EXE	NAPSTAT.EXE
PID 1408 wrote to memory of 268	1408	Explorer.EXE	NAPSTAT.EXE
PID 268 wrote to memory of 1372	268	NAPSTAT.EXE	cmd.exe
PID 268 wrote to memory of 1372	268	NAPSTAT.EXE	cmd.exe
PID 268 wrote to memory of 1372	268	NAPSTAT.EXE	cmd.exe
PID 268 wrote to memory of 1372	268	NAPSTAT.EXE	cmd.exe
PID 268 wrote to memory of 1844	268	NAPSTAT.EXE	Firefox.exe
PID 268 wrote to memory of 1844	268	NAPSTAT.EXE	Firefox.exe
PID 268 wrote to memory of 1844	268	NAPSTAT.EXE	Firefox.exe
PID 268 wrote to memory of 1844	268	NAPSTAT.EXE	Firefox.exe
PID 1408 wrote to memory of 1936	1408	Explorer.EXE	useruvzxkzix.exe
PID 1408 wrote to memory of 1936	1408	Explorer.EXE	useruvzxkzix.exe
PID 1408 wrote to memory of 1936	1408	Explorer.EXE	useruvzxkzix.exe
PID 1408 wrote to memory of 1936	1408	Explorer.EXE	useruvzxkzix.exe
PID 1936 wrote to memory of 1196	1936	useruvzxkzix.exe	useruvzxkzix.exe
PID 1936 wrote to memory of 1196	1936	useruvzxkzix.exe	useruvzxkzix.exe
PID 1936 wrote to memory of 1196	1936	useruvzxkzix.exe	useruvzxkzix.exe
PID 1936 wrote to memory of 1196	1936	useruvzxkzix.exe	useruvzxkzix.exe
PID 1936 wrote to memory of 1196	1936	useruvzxkzix.exe	useruvzxkzix.exe
PID 1936 wrote to memory of 1196	1936	useruvzxkzix.exe	useruvzxkzix.exe
PID 1936 wrote to memory of 1196	1936	useruvzxkzix.exe	useruvzxkzix.exe
PID 268 wrote to memory of 1844	268	NAPSTAT.EXE	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\Order-8011964-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order-8011964-pdf.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Local\Temp\Order-8011964-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order-8011964-pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Order-8011964-pdf.exe"
3⤵
- Deletes itself
PID:1372

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1844

C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe
"C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936

C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe
"C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe
MD5
e15ae6b598e9b227a07a09056570afd6

SHA1
46b5a6c316570f75be5f9732ece769547d431e39

SHA256
2c9c53afeadf78570137cbee063eb4446a2f2086d516b348199ed4500434c126

SHA512
9648aaae24b7384a12b3c165591c781c375cec2af31afa60002060d9ba81e0f4d616d50ac1e10dedd6d7c363a56ccdceb29598aac517d7dd4341b24256b93ad1

Download Submit
C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe
MD5
e15ae6b598e9b227a07a09056570afd6

SHA1
46b5a6c316570f75be5f9732ece769547d431e39

SHA256
2c9c53afeadf78570137cbee063eb4446a2f2086d516b348199ed4500434c126

SHA512
9648aaae24b7384a12b3c165591c781c375cec2af31afa60002060d9ba81e0f4d616d50ac1e10dedd6d7c363a56ccdceb29598aac517d7dd4341b24256b93ad1

Download Submit
C:\Program Files (x86)\Svzg4qd\useruvzxkzix.exe
MD5
e15ae6b598e9b227a07a09056570afd6

SHA1
46b5a6c316570f75be5f9732ece769547d431e39

SHA256
2c9c53afeadf78570137cbee063eb4446a2f2086d516b348199ed4500434c126

SHA512
9648aaae24b7384a12b3c165591c781c375cec2af31afa60002060d9ba81e0f4d616d50ac1e10dedd6d7c363a56ccdceb29598aac517d7dd4341b24256b93ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\a6ylm05jo4gf0gajx6
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\opqjvu
MD5
16b81501018934a97e3641de6ebf3a7c

SHA1
5a8f8458587bf029269fb2ac7734ae8ad0d2d202

SHA256
16b455bbbaef0c37b70e952628559c898a3b351c0a1e74e6fd8a88b384972182

SHA512
779761b156802289500d89b77fa703161a24d0dcafc7632b161e78e351f5e530faa7d723be77dbfc0be998dd1cbd839817588c7fe9dc6e9f430ef571a7581294

Download Submit
\Users\Admin\AppData\Local\Temp\nso91C6.tmp\kkixhqk.dll
MD5
3c5d78d7038df7b38383c988ceebe3aa

SHA1
20a6f418fb9650f54eaf3d1c6a63b7240684e4ed

SHA256
8bd3f637d66238b9fb72b7c78b38e8b72d81d85912ec9cf9d8166d5a42946317

SHA512
f819eaca443d595ff6ae171dfb17a7def3d16a7b8907d8636b0aa2dba7f0b044b6a67f01944a44f8df19d02cb07a6b931ebe1ce889de19ae0b3189826a6e0103

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDAF6.tmp\kkixhqk.dll
MD5
3c5d78d7038df7b38383c988ceebe3aa

SHA1
20a6f418fb9650f54eaf3d1c6a63b7240684e4ed

SHA256
8bd3f637d66238b9fb72b7c78b38e8b72d81d85912ec9cf9d8166d5a42946317

SHA512
f819eaca443d595ff6ae171dfb17a7def3d16a7b8907d8636b0aa2dba7f0b044b6a67f01944a44f8df19d02cb07a6b931ebe1ce889de19ae0b3189826a6e0103

Download Submit
memory/268-63-0x0000000000AA0000-0x0000000000DA3000-memory.dmp

Filesize
3.0MB

Download
memory/268-64-0x00000000007D0000-0x0000000000860000-memory.dmp

Filesize
576KB

Download
memory/268-62-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/268-61-0x0000000000EF0000-0x0000000000F36000-memory.dmp

Filesize
280KB

Download
memory/812-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download
memory/1196-75-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download
memory/1408-65-0x00000000072C0000-0x0000000007417000-memory.dmp

Filesize
1.3MB

Download
memory/1408-60-0x0000000006A40000-0x0000000006BD1000-memory.dmp

Filesize
1.6MB

Download
memory/2036-59-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/2036-58-0x00000000008E0000-0x0000000000BE3000-memory.dmp

Filesize
3.0MB

Download
memory/2036-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads