formbook | 45e8352d78b438ccf83d36f8679b58110a7296d65619f92e1f06c5da5d349ff9

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20220414-en
submitted
26-05-2022 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation 301086.exe
Size

342KB
MD5

770a74fcec9906c0e0cb99272fa59497
SHA1

844122ceb786ce1ee94b65626f1d76ce05cb201f
SHA256

45e8352d78b438ccf83d36f8679b58110a7296d65619f92e1f06c5da5d349ff9
SHA512

73f0899cbb8b3080f770af9248fcd1c5ddd8722c9d3c09131bdadea4ca4183a92c1af390bbe3f950d337f9ba205ce847b12c421301277fa1bed655cabec419dd

Score

10^/10

formbook xloader ygkp loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

ygkp

Decoy

cbdlively.com

1nfo-post.com

janejohnsonlmt.com

autotradecryptoswithjack.com

mustang-international.net

dreamthorp.com

alexandratanner.net

exilings.com

gzjdgjg.com

51minzhu.com

wgv.info

raymondjamesconsult.com

omariblair.com

vaalerahealth.com

outdoorvoiceshop.com

spbo.info

blasiandating.online

c01-cdn48-oxble.xyz

mrmycology.com

installturbooax.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1108-63-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/1108-64-0x000000000041F350-mapping.dmp	xloader
behavioral1/memory/1108-67-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/1288-73-0x0000000000080000-0x00000000000AB000-memory.dmp	xloader

Executes dropped EXE 3 IoCs

Processes:

iklxnv.exeiklxnv.execonfigengd.exe

pid process

1832 iklxnv.exe
1108 iklxnv.exe
1936 configengd.exe
Loads dropped DLL 6 IoCs

Processes:

Quotation 301086.exeiklxnv.exeWerFault.exe

pid process

852 Quotation 301086.exe
1832 iklxnv.exe
1912 WerFault.exe
1912 WerFault.exe
1912 WerFault.exe
1912 WerFault.exe

pid	process
1832	iklxnv.exe
1108	iklxnv.exe
1936	configengd.exe

pid	process
852	Quotation 301086.exe
1832	iklxnv.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wininit.exe

description	ioc	process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	wininit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T2DPL4P8_0H = "C:\\Program Files (x86)\\Kyvn\\configengd.exe"	wininit.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

iklxnv.exeiklxnv.exewininit.exe

description	pid	process	target process
PID 1832 set thread context of 1108	1832	iklxnv.exe	iklxnv.exe
PID 1108 set thread context of 1428	1108	iklxnv.exe	Explorer.EXE
PID 1288 set thread context of 1428	1288	wininit.exe	Explorer.EXE

Drops file in Program Files directory 2 IoCs

Processes:

wininit.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Kyvn\configengd.exe	wininit.exe
File created	C:\Program Files (x86)\Kyvn\configengd.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1912 1936 WerFault.exe configengd.exe

pid	pid_target	process	target process
1912	1936	WerFault.exe	configengd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

wininit.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wininit.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

iklxnv.exewininit.exe

pid	process
1108	iklxnv.exe
1108	iklxnv.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe
1288	wininit.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

iklxnv.exewininit.exe

pid process

1108 iklxnv.exe
1108 iklxnv.exe
1108 iklxnv.exe
1288 wininit.exe
1288 wininit.exe
1288 wininit.exe
1288 wininit.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

iklxnv.exewininit.exeExplorer.EXE

description pid process

Token: SeDebugPrivilege 1108 iklxnv.exe
Token: SeDebugPrivilege 1288 wininit.exe
Token: SeShutdownPrivilege 1428 Explorer.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1428 Explorer.EXE
1428 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1428 Explorer.EXE
1428 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1108	iklxnv.exe
Token: SeDebugPrivilege	1288	wininit.exe
Token: SeShutdownPrivilege	1428	Explorer.EXE

pid	process
1428	Explorer.EXE
1428	Explorer.EXE

pid	process
1428	Explorer.EXE
1428	Explorer.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

Quotation 301086.exeiklxnv.exeExplorer.EXEwininit.execonfigengd.exe

description	pid	process	target process
PID 852 wrote to memory of 1832	852	Quotation 301086.exe	iklxnv.exe
PID 852 wrote to memory of 1832	852	Quotation 301086.exe	iklxnv.exe
PID 852 wrote to memory of 1832	852	Quotation 301086.exe	iklxnv.exe
PID 852 wrote to memory of 1832	852	Quotation 301086.exe	iklxnv.exe
PID 1832 wrote to memory of 1108	1832	iklxnv.exe	iklxnv.exe
PID 1832 wrote to memory of 1108	1832	iklxnv.exe	iklxnv.exe
PID 1832 wrote to memory of 1108	1832	iklxnv.exe	iklxnv.exe
PID 1832 wrote to memory of 1108	1832	iklxnv.exe	iklxnv.exe
PID 1832 wrote to memory of 1108	1832	iklxnv.exe	iklxnv.exe
PID 1832 wrote to memory of 1108	1832	iklxnv.exe	iklxnv.exe
PID 1832 wrote to memory of 1108	1832	iklxnv.exe	iklxnv.exe
PID 1428 wrote to memory of 1288	1428	Explorer.EXE	wininit.exe
PID 1428 wrote to memory of 1288	1428	Explorer.EXE	wininit.exe
PID 1428 wrote to memory of 1288	1428	Explorer.EXE	wininit.exe
PID 1428 wrote to memory of 1288	1428	Explorer.EXE	wininit.exe
PID 1288 wrote to memory of 2028	1288	wininit.exe	cmd.exe
PID 1288 wrote to memory of 2028	1288	wininit.exe	cmd.exe
PID 1288 wrote to memory of 2028	1288	wininit.exe	cmd.exe
PID 1288 wrote to memory of 2028	1288	wininit.exe	cmd.exe
PID 1288 wrote to memory of 1016	1288	wininit.exe	Firefox.exe
PID 1288 wrote to memory of 1016	1288	wininit.exe	Firefox.exe
PID 1288 wrote to memory of 1016	1288	wininit.exe	Firefox.exe
PID 1288 wrote to memory of 1016	1288	wininit.exe	Firefox.exe
PID 1288 wrote to memory of 1016	1288	wininit.exe	Firefox.exe
PID 1428 wrote to memory of 1936	1428	Explorer.EXE	configengd.exe
PID 1428 wrote to memory of 1936	1428	Explorer.EXE	configengd.exe
PID 1428 wrote to memory of 1936	1428	Explorer.EXE	configengd.exe
PID 1428 wrote to memory of 1936	1428	Explorer.EXE	configengd.exe
PID 1936 wrote to memory of 1912	1936	configengd.exe	WerFault.exe
PID 1936 wrote to memory of 1912	1936	configengd.exe	WerFault.exe
PID 1936 wrote to memory of 1912	1936	configengd.exe	WerFault.exe
PID 1936 wrote to memory of 1912	1936	configengd.exe	WerFault.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\Quotation 301086.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation 301086.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe C:\Users\Admin\AppData\Local\Temp\vkbiykyy
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe C:\Users\Admin\AppData\Local\Temp\vkbiykyy
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\iklxnv.exe"
3⤵
PID:2028

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1016

C:\Program Files (x86)\Kyvn\configengd.exe
"C:\Program Files (x86)\Kyvn\configengd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 192
3⤵
- Loads dropped DLL
- Program crash
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Kyvn\configengd.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Program Files (x86)\Kyvn\configengd.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\d55z6aw3a97sxb697
Filesize
171KB

MD5
cc1c6353e5da67fa0bde02ccb2e4fe13

SHA1
723618954b69f3e8799d8342143a6550b9eefbda

SHA256
65a0b24dd02c6d636f143f7a4d4a492e04812b1462f42b5f3155a2f1f0f0e725

SHA512
2abb2fb78e34863a6445d341fe3fecf7cadaa3bfb1877bc31bbb33bd87995e44c327bc58562fb17b3ab71a54de1f7ad27f65e68ed4fe8d7f2083c92b1c4b4d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\vkbiykyy
Filesize
5KB

MD5
6ec4ee592fafd384a7a2382c4c97b6e5

SHA1
1acf339db76153a26d24c647671d1b4b5f6c7b4c

SHA256
45bdd4a262d4bc14e6e032521d11e73429a98faa3ad52daa4dbbe7d395460c7a

SHA512
dc494b4b032721e5578422898deb95fb9608777b70f4f3ff9c079f869540e07ce207d73fcad0e4e84565186029ee0be0f8c3edd728d39aef1d71ed0789f0e4ba

Download Submit
\Program Files (x86)\Kyvn\configengd.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
\Program Files (x86)\Kyvn\configengd.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
\Program Files (x86)\Kyvn\configengd.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
\Program Files (x86)\Kyvn\configengd.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
\Users\Admin\AppData\Local\Temp\iklxnv.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
\Users\Admin\AppData\Local\Temp\iklxnv.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
memory/852-54-0x0000000076781000-0x0000000076783000-memory.dmp

Filesize
8KB

Download
memory/1108-69-0x0000000000210000-0x0000000000221000-memory.dmp

Filesize
68KB

Download
memory/1108-68-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download
memory/1108-67-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1108-64-0x000000000041F350-mapping.dmp

Download
memory/1108-63-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1288-71-0x0000000000000000-mapping.dmp

Download
memory/1288-73-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/1288-72-0x0000000000990000-0x00000000009AA000-memory.dmp

Filesize
104KB

Download
memory/1288-75-0x00000000020D0000-0x00000000023D3000-memory.dmp

Filesize
3.0MB

Download
memory/1288-76-0x00000000005C0000-0x0000000000650000-memory.dmp

Filesize
576KB

Download
memory/1428-70-0x0000000006980000-0x0000000006AB7000-memory.dmp

Filesize
1.2MB

Download
memory/1428-77-0x0000000008E60000-0x0000000008FD7000-memory.dmp

Filesize
1.5MB

Download
memory/1832-56-0x0000000000000000-mapping.dmp

Download
memory/1912-82-0x0000000000000000-mapping.dmp

Download
memory/1936-79-0x0000000000000000-mapping.dmp

Download
memory/2028-74-0x0000000000000000-mapping.dmp

Download