formbook | 35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6

Target

INV21029.exe
Size

577KB
MD5

740dd9c14dea0b98df6ad434abfe789e
SHA1

cbec4d898e68c12fb7dcaddb17d0aca16e8e0e7b
SHA256

35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6
SHA512

66041e42091e83889a6da93c4242a01a0a3122774dc2db8baf909fb0ec6b0d6e847183ac92a24f2ca99f99de7dd4abddddda4a908887f354e3a333202bc0a66e

Score

10^/10

formbook xloader ahc8 loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/524-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1156-70-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

chkdsk.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	chkdsk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JXMXV4WPD6U = "C:\\Program Files (x86)\\E_0qlbpy\\Cookiesgralan.exe"	chkdsk.exe

Executes dropped EXE 3 IoCs

Processes:

reqbqonire.exereqbqonire.exeCookiesgralan.exe

pid process

908 reqbqonire.exe
524 reqbqonire.exe
1972 Cookiesgralan.exe
Loads dropped DLL 6 IoCs

Processes:

INV21029.exereqbqonire.exeWerFault.exe

pid process

1152 INV21029.exe
908 reqbqonire.exe
1084 WerFault.exe
1084 WerFault.exe
1084 WerFault.exe
1084 WerFault.exe

pid	process
908	reqbqonire.exe
524	reqbqonire.exe
1972	Cookiesgralan.exe

pid	process
1152	INV21029.exe
908	reqbqonire.exe
1084	WerFault.exe
1084	WerFault.exe
1084	WerFault.exe
1084	WerFault.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

reqbqonire.exereqbqonire.exechkdsk.exe

description	pid	process	target process
PID 908 set thread context of 524	908	reqbqonire.exe	reqbqonire.exe
PID 524 set thread context of 1404	524	reqbqonire.exe	Explorer.EXE
PID 1156 set thread context of 1404	1156	chkdsk.exe	Explorer.EXE

Drops file in Program Files directory 2 IoCs

Processes:

Explorer.EXEchkdsk.exe

description	ioc	process
File created	C:\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe	chkdsk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1084 1972 WerFault.exe Cookiesgralan.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

pid	pid_target	process	target process
1084	1972	WerFault.exe	Cookiesgralan.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

chkdsk.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1405931862-909307831-4085185274-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

reqbqonire.exechkdsk.exeWerFault.exe

pid	process
524	reqbqonire.exe
524	reqbqonire.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1156	chkdsk.exe
1084	WerFault.exe
1084	WerFault.exe
1084	WerFault.exe
1084	WerFault.exe
1156	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1404 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

reqbqonire.exechkdsk.exe

pid process

524 reqbqonire.exe
524 reqbqonire.exe
524 reqbqonire.exe
1156 chkdsk.exe
1156 chkdsk.exe
1156 chkdsk.exe
1156 chkdsk.exe

pid	process
1404	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

reqbqonire.exechkdsk.exeWerFault.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	524	reqbqonire.exe
Token: SeDebugPrivilege	1156	chkdsk.exe
Token: SeDebugPrivilege	1084	WerFault.exe
Token: SeShutdownPrivilege	1404	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1404 Explorer.EXE
1404 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1404 Explorer.EXE
1404 Explorer.EXE

pid	process
1404	Explorer.EXE
1404	Explorer.EXE

pid	process
1404	Explorer.EXE
1404	Explorer.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

INV21029.exereqbqonire.exeExplorer.EXEchkdsk.exeCookiesgralan.exe

description	pid	process	target process
PID 1152 wrote to memory of 908	1152	INV21029.exe	reqbqonire.exe
PID 1152 wrote to memory of 908	1152	INV21029.exe	reqbqonire.exe
PID 1152 wrote to memory of 908	1152	INV21029.exe	reqbqonire.exe
PID 1152 wrote to memory of 908	1152	INV21029.exe	reqbqonire.exe
PID 908 wrote to memory of 524	908	reqbqonire.exe	reqbqonire.exe
PID 908 wrote to memory of 524	908	reqbqonire.exe	reqbqonire.exe
PID 908 wrote to memory of 524	908	reqbqonire.exe	reqbqonire.exe
PID 908 wrote to memory of 524	908	reqbqonire.exe	reqbqonire.exe
PID 908 wrote to memory of 524	908	reqbqonire.exe	reqbqonire.exe
PID 908 wrote to memory of 524	908	reqbqonire.exe	reqbqonire.exe
PID 908 wrote to memory of 524	908	reqbqonire.exe	reqbqonire.exe
PID 1404 wrote to memory of 1156	1404	Explorer.EXE	chkdsk.exe
PID 1404 wrote to memory of 1156	1404	Explorer.EXE	chkdsk.exe
PID 1404 wrote to memory of 1156	1404	Explorer.EXE	chkdsk.exe
PID 1404 wrote to memory of 1156	1404	Explorer.EXE	chkdsk.exe
PID 1156 wrote to memory of 1504	1156	chkdsk.exe	cmd.exe
PID 1156 wrote to memory of 1504	1156	chkdsk.exe	cmd.exe
PID 1156 wrote to memory of 1504	1156	chkdsk.exe	cmd.exe
PID 1156 wrote to memory of 1504	1156	chkdsk.exe	cmd.exe
PID 1156 wrote to memory of 896	1156	chkdsk.exe	Firefox.exe
PID 1156 wrote to memory of 896	1156	chkdsk.exe	Firefox.exe
PID 1156 wrote to memory of 896	1156	chkdsk.exe	Firefox.exe
PID 1156 wrote to memory of 896	1156	chkdsk.exe	Firefox.exe
PID 1404 wrote to memory of 1972	1404	Explorer.EXE	Cookiesgralan.exe
PID 1404 wrote to memory of 1972	1404	Explorer.EXE	Cookiesgralan.exe
PID 1404 wrote to memory of 1972	1404	Explorer.EXE	Cookiesgralan.exe
PID 1404 wrote to memory of 1972	1404	Explorer.EXE	Cookiesgralan.exe
PID 1972 wrote to memory of 1084	1972	Cookiesgralan.exe	WerFault.exe
PID 1972 wrote to memory of 1084	1972	Cookiesgralan.exe	WerFault.exe
PID 1972 wrote to memory of 1084	1972	Cookiesgralan.exe	WerFault.exe
PID 1972 wrote to memory of 1084	1972	Cookiesgralan.exe	WerFault.exe
PID 1156 wrote to memory of 896	1156	chkdsk.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\INV21029.exe
"C:\Users\Admin\AppData\Local\Temp\INV21029.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152

C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:908

C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe"
3⤵
PID:1504

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:896

C:\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe
"C:\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 160
3⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
C:\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1djuqculeikkmhtz2x2
MD5
199f72b6103b1ad570f3a810d06c332a

SHA1
43b9341301394deec3c674cf98fc3c6cc629ee2b

SHA256
a61bbd1659ba2338fe6e4df411d709834285b54991c403ba07bc9459af5320fc

SHA512
0ce6be58193b0bcdccd003218597ce8f6bd0de35563c32d28c2e111903445f12ece5fa0a536dd2b79153b9c265c10a6ec17f8ef67b11edb95d155c0f502adeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\truuumm
MD5
0a99632c69bc8d3fe6231d0a50bff785

SHA1
ad875f4428f17d0474be5ee8667158bd14d10f22

SHA256
0a11eae20268581b0ad9c67defaf1a4dc4bf183ede922eca10c5da698eec8078

SHA512
93905216a40975163edfcc94cf3c55c40a27e4cf7143d028ef6c5caead6ceaaa1504bd4c5a05d043d61be3df08991ea7e1e8c98cdfafd9d8744ccacdc5d7de2f

Download Submit
\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
\Program Files (x86)\E_0qlbpy\Cookiesgralan.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
\Users\Admin\AppData\Local\Temp\reqbqonire.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
\Users\Admin\AppData\Local\Temp\reqbqonire.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
memory/524-67-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/524-65-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/524-66-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/524-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-84-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/1152-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1156-70-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/1156-71-0x0000000001F60000-0x0000000002263000-memory.dmp

Filesize
3.0MB

Download
memory/1156-69-0x00000000005F0000-0x00000000005F7000-memory.dmp

Filesize
28KB

Download
memory/1156-72-0x0000000001D20000-0x0000000001DB0000-memory.dmp

Filesize
576KB

Download
memory/1404-73-0x00000000048E0000-0x00000000049EB000-memory.dmp

Filesize
1.0MB

Download
memory/1404-68-0x0000000006CD0000-0x0000000006E4D000-memory.dmp

Filesize
1.5MB

Download