formbook

General

Target

STD 35 GA Plan_doc.exe
Size

867KB
Sample

220712-ktxvssahhk
MD5

d367a1f17ef481d21775f424c4beb7b7
SHA1

fc083e789e7f06627bf3465f74524a5758896f32
SHA256

5846e4c3d380772683c6398d37c33d7a3484762fccd6d8636b2b5d337637d00a
SHA512

2b9c821c00989e6cf9ee1279f8d34d8d02f3af5e07269d34e8e29c6a137e66522eff8211fb3c68bfafaef099aaec926a0a070bc940dd94f30657061b98541566

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.9

Campaign

iewb

Decoy

n8FLlgIlb1rSEg5hJ9xMbw4hcmR38Q==

5vIAIY+pt81OtWs+FdIEdk7Y

LHIKc+oWGIQUUlfAAtEEdk7Y

ePM/cX2jvHrS

5hvPEw22+fdvmJz3C8FIVq0=

mb9EeX2jvHrS

Dx2zIYNvfjo8VUo5

6jVPnyJekv2RAc4gLKNwEqQ=

KWatHyjdE5Gj1Ng=

t9lk70gzUAZty4qjbVjF

6eUBeFPzKBWT125BFNIEdk7Y

dZUXOIyqTJGj1Ng=

iL3TVh2Jl5QVStnzxcAhIL8=

J1prtyklUfZGR/xDD71IbkWRd2yx

s9FgCOBRW9bU0Y6jbVjF

RYCbQDzcFBhcylgu

Fl0BV/8RJm6F9QRg8LXXTLo=

0dhumHzrCCZ3wdQg7nFF1AlL6Tk=

xvL+iL6wwX+/wH9K4lbZ/A==

N0lVceIFD5Gj1Ng=

Targets

- Target
  
  STD 35 GA Plan_doc.exe
- Size
  
  867KB
- MD5
  
  d367a1f17ef481d21775f424c4beb7b7
- SHA1
  
  fc083e789e7f06627bf3465f74524a5758896f32
- SHA256
  
  5846e4c3d380772683c6398d37c33d7a3484762fccd6d8636b2b5d337637d00a
- SHA512
  
  2b9c821c00989e6cf9ee1279f8d34d8d02f3af5e07269d34e8e29c6a137e66522eff8211fb3c68bfafaef099aaec926a0a070bc940dd94f30657061b98541566
Score

10^/10

formbook xloader iewb loader persistence rat spyware stealer suricata trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- suricata: ET MALWARE FormBook CnC Checkin (GET)
  suricata: ET MALWARE FormBook CnC Checkin (GET)
  suricata
- Xloader payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader

suricata: ET MALWARE FormBook CnC Checkin (GET)

Xloader payload

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2