formbook | 45e8352d78b438ccf83d36f8679b58110a7296d65619f92e1f06c5da5d349ff9

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-05-2022 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation 301086.exe
Size

342KB
MD5

770a74fcec9906c0e0cb99272fa59497
SHA1

844122ceb786ce1ee94b65626f1d76ce05cb201f
SHA256

45e8352d78b438ccf83d36f8679b58110a7296d65619f92e1f06c5da5d349ff9
SHA512

73f0899cbb8b3080f770af9248fcd1c5ddd8722c9d3c09131bdadea4ca4183a92c1af390bbe3f950d337f9ba205ce847b12c421301277fa1bed655cabec419dd

Score

10^/10

formbook xloader ygkp loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

ygkp

Decoy

cbdlively.com

1nfo-post.com

janejohnsonlmt.com

autotradecryptoswithjack.com

mustang-international.net

dreamthorp.com

alexandratanner.net

exilings.com

gzjdgjg.com

51minzhu.com

wgv.info

raymondjamesconsult.com

omariblair.com

vaalerahealth.com

outdoorvoiceshop.com

spbo.info

blasiandating.online

c01-cdn48-oxble.xyz

mrmycology.com

installturbooax.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4696-136-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/4136-145-0x0000000000CA0000-0x0000000000CCB000-memory.dmp	xloader

Executes dropped EXE 3 IoCs

Processes:

iklxnv.exeiklxnv.exei0uf6qlhz9h.exe

pid process

3384 iklxnv.exe
4696 iklxnv.exe
2484 i0uf6qlhz9h.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3384	iklxnv.exe
4696	iklxnv.exe
2484	i0uf6qlhz9h.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ipconfig.exe

description	ioc	process
Key created	\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ipconfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8PXXSPMX = "C:\\Program Files (x86)\\Zilydufw\\i0uf6qlhz9h.exe"	ipconfig.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

iklxnv.exeiklxnv.exeipconfig.exe

description	pid	process	target process
PID 3384 set thread context of 4696	3384	iklxnv.exe	iklxnv.exe
PID 4696 set thread context of 2896	4696	iklxnv.exe	Explorer.EXE
PID 4136 set thread context of 2896	4136	ipconfig.exe	Explorer.EXE

Drops file in Program Files directory 4 IoCs

Processes:

Explorer.EXEipconfig.exe

description	ioc	process
File created	C:\Program Files (x86)\Zilydufw\i0uf6qlhz9h.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Zilydufw\i0uf6qlhz9h.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Zilydufw\i0uf6qlhz9h.exe	ipconfig.exe
File opened for modification	C:\Program Files (x86)\Zilydufw	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3696 2484 WerFault.exe i0uf6qlhz9h.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

4136 ipconfig.exe

pid	pid_target	process	target process
3696	2484	WerFault.exe	i0uf6qlhz9h.exe

pid	process
4136	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ipconfig.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

iklxnv.exeipconfig.exe

pid	process
4696	iklxnv.exe
4696	iklxnv.exe
4696	iklxnv.exe
4696	iklxnv.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe
4136	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2896 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

iklxnv.exeipconfig.exe

pid process

4696 iklxnv.exe
4696 iklxnv.exe
4696 iklxnv.exe
4136 ipconfig.exe
4136 ipconfig.exe
4136 ipconfig.exe
4136 ipconfig.exe

pid	process
2896	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

iklxnv.exeipconfig.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4696	iklxnv.exe
Token: SeDebugPrivilege	4136	ipconfig.exe
Token: SeShutdownPrivilege	2896	Explorer.EXE
Token: SeCreatePagefilePrivilege	2896	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Quotation 301086.exeiklxnv.exeExplorer.EXEipconfig.exe

description	pid	process	target process
PID 3488 wrote to memory of 3384	3488	Quotation 301086.exe	iklxnv.exe
PID 3488 wrote to memory of 3384	3488	Quotation 301086.exe	iklxnv.exe
PID 3488 wrote to memory of 3384	3488	Quotation 301086.exe	iklxnv.exe
PID 3384 wrote to memory of 4696	3384	iklxnv.exe	iklxnv.exe
PID 3384 wrote to memory of 4696	3384	iklxnv.exe	iklxnv.exe
PID 3384 wrote to memory of 4696	3384	iklxnv.exe	iklxnv.exe
PID 3384 wrote to memory of 4696	3384	iklxnv.exe	iklxnv.exe
PID 3384 wrote to memory of 4696	3384	iklxnv.exe	iklxnv.exe
PID 3384 wrote to memory of 4696	3384	iklxnv.exe	iklxnv.exe
PID 2896 wrote to memory of 4136	2896	Explorer.EXE	ipconfig.exe
PID 2896 wrote to memory of 4136	2896	Explorer.EXE	ipconfig.exe
PID 2896 wrote to memory of 4136	2896	Explorer.EXE	ipconfig.exe
PID 4136 wrote to memory of 4368	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 4368	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 4368	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 4128	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 4128	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 4128	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 2456	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 2456	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 2456	4136	ipconfig.exe	cmd.exe
PID 4136 wrote to memory of 1036	4136	ipconfig.exe	Firefox.exe
PID 4136 wrote to memory of 1036	4136	ipconfig.exe	Firefox.exe
PID 4136 wrote to memory of 1036	4136	ipconfig.exe	Firefox.exe
PID 2896 wrote to memory of 2484	2896	Explorer.EXE	i0uf6qlhz9h.exe
PID 2896 wrote to memory of 2484	2896	Explorer.EXE	i0uf6qlhz9h.exe
PID 2896 wrote to memory of 2484	2896	Explorer.EXE	i0uf6qlhz9h.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896

C:\Users\Admin\AppData\Local\Temp\Quotation 301086.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation 301086.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3488

C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe C:\Users\Admin\AppData\Local\Temp\vkbiykyy
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3384

C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe C:\Users\Admin\AppData\Local\Temp\vkbiykyy
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1188

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\iklxnv.exe"
3⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:4128

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:2456

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1036

C:\Program Files (x86)\Zilydufw\i0uf6qlhz9h.exe
"C:\Program Files (x86)\Zilydufw\i0uf6qlhz9h.exe"
2⤵
- Executes dropped EXE
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 496
3⤵
- Program crash
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2484 -ip 2484
1⤵
PID:2992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Zilydufw\i0uf6qlhz9h.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Program Files (x86)\Zilydufw\i0uf6qlhz9h.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB1
Filesize
40KB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB1
Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\d55z6aw3a97sxb697
Filesize
171KB

MD5
cc1c6353e5da67fa0bde02ccb2e4fe13

SHA1
723618954b69f3e8799d8342143a6550b9eefbda

SHA256
65a0b24dd02c6d636f143f7a4d4a492e04812b1462f42b5f3155a2f1f0f0e725

SHA512
2abb2fb78e34863a6445d341fe3fecf7cadaa3bfb1877bc31bbb33bd87995e44c327bc58562fb17b3ab71a54de1f7ad27f65e68ed4fe8d7f2083c92b1c4b4d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\iklxnv.exe
Filesize
187KB

MD5
dc3b25215baca266c185f2bad746e8df

SHA1
3a8e09485d86a00f32619f845f044dff29f0d1e6

SHA256
ffda6eaa7ea9b404b396d473467c92ec05c710ec7ac3a323c1f037d008ba54f9

SHA512
e4435b80f375856bdc7a31af1e6886ffabafebe6927aec03b36f99bc42f361650f823595caa46b93f05c5f7036cf2745344befdaf0d6d13c470f620293eb4faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\vkbiykyy
Filesize
5KB

MD5
6ec4ee592fafd384a7a2382c4c97b6e5

SHA1
1acf339db76153a26d24c647671d1b4b5f6c7b4c

SHA256
45bdd4a262d4bc14e6e032521d11e73429a98faa3ad52daa4dbbe7d395460c7a

SHA512
dc494b4b032721e5578422898deb95fb9608777b70f4f3ff9c079f869540e07ce207d73fcad0e4e84565186029ee0be0f8c3edd728d39aef1d71ed0789f0e4ba

Download Submit
memory/2456-151-0x0000000000000000-mapping.dmp

Download
memory/2484-153-0x0000000000000000-mapping.dmp

Download
memory/2896-141-0x0000000002920000-0x0000000002A20000-memory.dmp

Filesize
1024KB

Download
memory/2896-148-0x0000000007EF0000-0x000000000802B000-memory.dmp

Filesize
1.2MB

Download
memory/3384-130-0x0000000000000000-mapping.dmp

Download
memory/4128-149-0x0000000000000000-mapping.dmp

Download
memory/4136-144-0x00000000009E0000-0x00000000009EB000-memory.dmp

Filesize
44KB

Download
memory/4136-145-0x0000000000CA0000-0x0000000000CCB000-memory.dmp

Filesize
172KB

Download
memory/4136-146-0x00000000014F0000-0x000000000183A000-memory.dmp

Filesize
3.3MB

Download
memory/4136-147-0x0000000001280000-0x0000000001310000-memory.dmp

Filesize
576KB

Download
memory/4136-142-0x0000000000000000-mapping.dmp

Download
memory/4368-143-0x0000000000000000-mapping.dmp

Download
memory/4696-140-0x00000000017B0000-0x00000000017C1000-memory.dmp

Filesize
68KB

Download
memory/4696-139-0x00000000017E0000-0x0000000001B2A000-memory.dmp

Filesize
3.3MB

Download
memory/4696-136-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4696-135-0x0000000000000000-mapping.dmp

Download