formbook | 27331403cd4e737d09c723eaa8ad57607f4a243a1fcde752443af581b9141092

General

Target

order.exe
Size

242KB
MD5

1fca4a7a2a1bc5631ae3bed8065a9167
SHA1

631a8a37179b57365515e1b4741305d75928342e
SHA256

27331403cd4e737d09c723eaa8ad57607f4a243a1fcde752443af581b9141092
SHA512

ac4bc3e02782b8ac894caa2eb536eb193e460b011bdf4926649ac4416bbf96642a7aeaa0f60a5e739ea5d7553e411e8674f4399b5a6f0443070fe963ec8739a0

Score

10^/10

formbook xloader cbgo loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cbgo

Decoy

santesha.com

britneysbeautybar.com

sh-cy17.com

jeffcarveragency.com

3117111.com

sobrehosting.net

ddm123.xyz

toxcompliance.com

auditorydesigns.com

vliftfacial.com

ielhii.com

naameliss.com

ritualchariot.com

solchange.com

quatre-vingts.design

lawnmowermashine.com

braceletsstore.net

admappy.com

tollivercoltd.com

vaidix.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4808-130-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/948-139-0x0000000001260000-0x0000000001289000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

93 948 msiexec.exe
Executes dropped EXE 3 IoCs

Processes:

ceozrdkqb.execeozrdkqb.exezdfh8pxdrht.exe

pid process

4772 ceozrdkqb.exe
4808 ceozrdkqb.exe
224 zdfh8pxdrht.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
93	948	msiexec.exe

pid	process
4772	ceozrdkqb.exe
4808	ceozrdkqb.exe
224	zdfh8pxdrht.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MBI0KZIXEXQ = "C:\\Program Files (x86)\\Scb0hubkp\\zdfh8pxdrht.exe"	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ceozrdkqb.execeozrdkqb.exemsiexec.exe

description	pid	process	target process
PID 4772 set thread context of 4808	4772	ceozrdkqb.exe	ceozrdkqb.exe
PID 4808 set thread context of 2064	4808	ceozrdkqb.exe	Explorer.EXE
PID 948 set thread context of 2064	948	msiexec.exe	Explorer.EXE

Drops file in Program Files directory 4 IoCs

Processes:

Explorer.EXEmsiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Scb0hubkp\zdfh8pxdrht.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Scb0hubkp\zdfh8pxdrht.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Scb0hubkp\zdfh8pxdrht.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Scb0hubkp	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1560 224 WerFault.exe zdfh8pxdrht.exe

pid	pid_target	process	target process
1560	224	WerFault.exe	zdfh8pxdrht.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	msiexec.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

ceozrdkqb.exemsiexec.exe

pid	process
4808	ceozrdkqb.exe
4808	ceozrdkqb.exe
4808	ceozrdkqb.exe
4808	ceozrdkqb.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe
948	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2064 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

ceozrdkqb.exemsiexec.exe

pid process

4808 ceozrdkqb.exe
4808 ceozrdkqb.exe
4808 ceozrdkqb.exe
948 msiexec.exe
948 msiexec.exe
948 msiexec.exe
948 msiexec.exe

pid	process
2064	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

ceozrdkqb.exemsiexec.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4808	ceozrdkqb.exe
Token: SeDebugPrivilege	948	msiexec.exe
Token: SeShutdownPrivilege	2064	Explorer.EXE
Token: SeCreatePagefilePrivilege	2064	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

order.execeozrdkqb.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 2776 wrote to memory of 4772	2776	order.exe	ceozrdkqb.exe
PID 2776 wrote to memory of 4772	2776	order.exe	ceozrdkqb.exe
PID 2776 wrote to memory of 4772	2776	order.exe	ceozrdkqb.exe
PID 4772 wrote to memory of 4808	4772	ceozrdkqb.exe	ceozrdkqb.exe
PID 4772 wrote to memory of 4808	4772	ceozrdkqb.exe	ceozrdkqb.exe
PID 4772 wrote to memory of 4808	4772	ceozrdkqb.exe	ceozrdkqb.exe
PID 4772 wrote to memory of 4808	4772	ceozrdkqb.exe	ceozrdkqb.exe
PID 4772 wrote to memory of 4808	4772	ceozrdkqb.exe	ceozrdkqb.exe
PID 4772 wrote to memory of 4808	4772	ceozrdkqb.exe	ceozrdkqb.exe
PID 2064 wrote to memory of 948	2064	Explorer.EXE	msiexec.exe
PID 2064 wrote to memory of 948	2064	Explorer.EXE	msiexec.exe
PID 2064 wrote to memory of 948	2064	Explorer.EXE	msiexec.exe
PID 948 wrote to memory of 4968	948	msiexec.exe	cmd.exe
PID 948 wrote to memory of 4968	948	msiexec.exe	cmd.exe
PID 948 wrote to memory of 4968	948	msiexec.exe	cmd.exe
PID 948 wrote to memory of 3376	948	msiexec.exe	cmd.exe
PID 948 wrote to memory of 3376	948	msiexec.exe	cmd.exe
PID 948 wrote to memory of 3376	948	msiexec.exe	cmd.exe
PID 948 wrote to memory of 4172	948	msiexec.exe	Firefox.exe
PID 948 wrote to memory of 4172	948	msiexec.exe	Firefox.exe
PID 2064 wrote to memory of 224	2064	Explorer.EXE	zdfh8pxdrht.exe
PID 2064 wrote to memory of 224	2064	Explorer.EXE	zdfh8pxdrht.exe
PID 2064 wrote to memory of 224	2064	Explorer.EXE	zdfh8pxdrht.exe
PID 948 wrote to memory of 4172	948	msiexec.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772

C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe"
3⤵
PID:4968

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:3376

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4172

C:\Program Files (x86)\Scb0hubkp\zdfh8pxdrht.exe
"C:\Program Files (x86)\Scb0hubkp\zdfh8pxdrht.exe"
2⤵
- Executes dropped EXE
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 580
3⤵
- Program crash
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 224 -ip 224
1⤵
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Scb0hubkp\zdfh8pxdrht.exe
Filesize
6KB

MD5
28692b8f1f61c582b540a086820097e9

SHA1
a57f8bf69b2c89947d91b3eb968e4925b447b273

SHA256
7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

SHA512
29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

Download Submit
C:\Program Files (x86)\Scb0hubkp\zdfh8pxdrht.exe
Filesize
6KB

MD5
28692b8f1f61c582b540a086820097e9

SHA1
a57f8bf69b2c89947d91b3eb968e4925b447b273

SHA256
7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

SHA512
29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB1
Filesize
40KB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
Filesize
6KB

MD5
28692b8f1f61c582b540a086820097e9

SHA1
a57f8bf69b2c89947d91b3eb968e4925b447b273

SHA256
7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

SHA512
29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
Filesize
6KB

MD5
28692b8f1f61c582b540a086820097e9

SHA1
a57f8bf69b2c89947d91b3eb968e4925b447b273

SHA256
7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

SHA512
29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
Filesize
6KB

MD5
28692b8f1f61c582b540a086820097e9

SHA1
a57f8bf69b2c89947d91b3eb968e4925b447b273

SHA256
7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

SHA512
29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
Filesize
4KB

MD5
9bac10f869bf8307d17de84fbb4d2393

SHA1
90af62da1c66391e0267b984a9cc92268e9cafec

SHA256
7cbb56af0e0ffb9b752368cbc204fe48a197d2c5df76fb30b09e5b9110d50d13

SHA512
2f047b48e736f3fc4ea66952866c1854bb765ef4c8e34321b0c230c70cb40fd948d5b094101586dec051a7c47ec0e3dfbd9a593d1a857e24815eab51f7ecee17

Download Submit
C:\Users\Admin\AppData\Local\Temp\t5jmbsy9kwg1m2u7ebq
Filesize
212KB

MD5
562c6825bc59812dfe147ff9d86ef126

SHA1
b6e7f2ebe369cef46c22c5990a2d5c78b2d17a07

SHA256
88b6b55757f0195147295c30faff512bf31a80ec2a83fff86c43d4cfd97a2da8

SHA512
9bab1f20f75310be1d2b28ccb492095e481cb7627dd002857beb7c87071ab11d47b159ee45e85049b3e9328bdd1a9e34f56a7dfa22e3fcaadbffe5c473f74483

Download Submit
memory/224-145-0x0000000000000000-mapping.dmp

Download
memory/948-140-0x0000000003130000-0x000000000347A000-memory.dmp

Filesize
3.3MB

Download
memory/948-141-0x0000000002F90000-0x0000000003020000-memory.dmp

Filesize
576KB

Download
memory/948-136-0x0000000000000000-mapping.dmp

Download
memory/948-139-0x0000000001260000-0x0000000001289000-memory.dmp

Filesize
164KB

Download
memory/948-138-0x00000000005C0000-0x00000000005D2000-memory.dmp

Filesize
72KB

Download
memory/2064-135-0x0000000002A90000-0x0000000002BA9000-memory.dmp

Filesize
1.1MB

Download
memory/2064-142-0x0000000007D30000-0x0000000007EBE000-memory.dmp

Filesize
1.6MB

Download
memory/3376-143-0x0000000000000000-mapping.dmp

Download
memory/4772-124-0x0000000000000000-mapping.dmp

Download
memory/4808-134-0x0000000000DE0000-0x0000000000DF1000-memory.dmp

Filesize
68KB

Download
memory/4808-133-0x00000000012A0000-0x00000000015EA000-memory.dmp

Filesize
3.3MB

Download
memory/4808-130-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4808-129-0x0000000000000000-mapping.dmp

Download
memory/4968-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads