formbook | ae9b827c9ea8f76498bd357516a966d63a386ae681d57a7defe9b90d5dfec29a

General

Target

tmp.exe
Size

269KB
MD5

ab19893b5cb5cc981ae08a3964f16e15
SHA1

23b5898bcc3ab1fb60a85f46cec31e6b29c6f114
SHA256

ae9b827c9ea8f76498bd357516a966d63a386ae681d57a7defe9b90d5dfec29a
SHA512

56fb7e6b073b54f31eb5c7bbd0da85eb8ad12f88988406e27ee332ae2225660b73465b208cffd5ccb73c7c982300a88f96c8e5032544a9eeb1887c3d463dbb33
SSDEEP

6144:GmubVdOGB4obzF7lT0J1SfNFL3tbUdsSxX7/BWjqFw9Qd:sZ2obzpi8F93twdsSV7ZTFo

Score

10^/10

formbook xloader ph6j loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

ph6j

Decoy

WM1X00j5iDAYA6zcncQr

3CPsxwpxiZ+SikeciM4y

XDDKDkvuplKRxq7feLyksK6Z0g==

/msAxzfw/5RdtIwTnk4=

GHxNObZXuq2sys8=

GPXEaDIkd59RoawN

5M9MVMeb3o4NDeAt4wTxd7OY0A==

A9xTe+i4ZXwyiJvfyapcIw==

RaIVfPihP24siJq9ZtH+s1Y=

B/6EfAHA2/QDKCuTLEv47tg22b7kZQ==

uCu5N6ha86KYvYwTnk4=

vyLwu/BkYQyEhi4Vi7oirhXXOqI=

pv66ktZy6mbiAQ==

jtVK3hed6mbiAQ==

awdUpNKVm80=

NhPiQbxl+x3MEaXauk31+bXZ

OfObW8qMDUjDR+0F

4Wk7Ip9e2wi+AvWciM4y

eGAriArN1AItvGBnMQ==

5bF+B0DO+CJTnjFT+wmvsK6Z0g==

Extracted

Family

xloader

Version

3.ƅ

Campaign

ph6j

Decoy

WM1X00j5iDAYA6zcncQr

3CPsxwpxiZ+SikeciM4y

XDDKDkvuplKRxq7feLyksK6Z0g==

/msAxzfw/5RdtIwTnk4=

GHxNObZXuq2sys8=

GPXEaDIkd59RoawN

5M9MVMeb3o4NDeAt4wTxd7OY0A==

A9xTe+i4ZXwyiJvfyapcIw==

RaIVfPihP24siJq9ZtH+s1Y=

B/6EfAHA2/QDKCuTLEv47tg22b7kZQ==

uCu5N6ha86KYvYwTnk4=

vyLwu/BkYQyEhi4Vi7oirhXXOqI=

pv66ktZy6mbiAQ==

jtVK3hed6mbiAQ==

awdUpNKVm80=

NhPiQbxl+x3MEaXauk31+bXZ

OfObW8qMDUjDR+0F

4Wk7Ip9e2wi+AvWciM4y

eGAriArN1AItvGBnMQ==

5bF+B0DO+CJTnjFT+wmvsK6Z0g==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Loads dropped DLL 1 IoCs

Processes:

NAPSTAT.EXE

pid process

1104 NAPSTAT.EXE

pid	process
1104	NAPSTAT.EXE

Suspicious use of SetThreadContext 3 IoCs

Processes:

tmp.exeRegsvcs.exeNAPSTAT.EXE

description	pid	process	target process
PID 1424 set thread context of 1344	1424	tmp.exe	Regsvcs.exe
PID 1344 set thread context of 1260	1344	Regsvcs.exe	Explorer.EXE
PID 1104 set thread context of 1260	1104	NAPSTAT.EXE	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

NAPSTAT.EXE

description	ioc	process
Key created	\Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	NAPSTAT.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

Regsvcs.exeNAPSTAT.EXE

pid	process
1344	Regsvcs.exe
1344	Regsvcs.exe
1344	Regsvcs.exe
1344	Regsvcs.exe
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE
1104	NAPSTAT.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Regsvcs.exeNAPSTAT.EXE

pid process

1344 Regsvcs.exe
1344 Regsvcs.exe
1344 Regsvcs.exe
1104 NAPSTAT.EXE
1104 NAPSTAT.EXE
1104 NAPSTAT.EXE
1104 NAPSTAT.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Regsvcs.exeNAPSTAT.EXE

description pid process

Token: SeDebugPrivilege 1344 Regsvcs.exe
Token: SeDebugPrivilege 1104 NAPSTAT.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1260 Explorer.EXE
1260 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1260 Explorer.EXE
1260 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1344	Regsvcs.exe
Token: SeDebugPrivilege	1104	NAPSTAT.EXE

pid	process
1260	Explorer.EXE
1260	Explorer.EXE

pid	process
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

tmp.exeExplorer.EXENAPSTAT.EXE

description	pid	process	target process
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1424 wrote to memory of 1344	1424	tmp.exe	Regsvcs.exe
PID 1260 wrote to memory of 1104	1260	Explorer.EXE	NAPSTAT.EXE
PID 1260 wrote to memory of 1104	1260	Explorer.EXE	NAPSTAT.EXE
PID 1260 wrote to memory of 1104	1260	Explorer.EXE	NAPSTAT.EXE
PID 1260 wrote to memory of 1104	1260	Explorer.EXE	NAPSTAT.EXE
PID 1104 wrote to memory of 1124	1104	NAPSTAT.EXE	Firefox.exe
PID 1104 wrote to memory of 1124	1104	NAPSTAT.EXE	Firefox.exe
PID 1104 wrote to memory of 1124	1104	NAPSTAT.EXE	Firefox.exe
PID 1104 wrote to memory of 1124	1104	NAPSTAT.EXE	Firefox.exe
PID 1104 wrote to memory of 1124	1104	NAPSTAT.EXE	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\sqlite3.dll
Filesize
804KB

MD5
b09588d000ef4bf2a3dddd85bd701423

SHA1
44a810ff8920a340a30b66d932253555143dc28b

SHA256
ce4ffc1a12150b8523378553f2a97dd3fc44d5210ae6c296ab31e2c78f0d03c3

SHA512
1d807d92da34ccba4628f2a55c3ac1c03ff63925d79e266b4e52d71002228cbde76206ec696c3e25143fc2e0cab56589155666ff6f8ea0ebfd5ebcd362168e2a

Download Submit
memory/1104-69-0x0000000000000000-mapping.dmp

Download
memory/1104-77-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1104-76-0x00000000000C0000-0x00000000000ED000-memory.dmp

Filesize
180KB

Download
memory/1104-73-0x00000000003C0000-0x000000000044F000-memory.dmp

Filesize
572KB

Download
memory/1104-72-0x0000000001FF0000-0x00000000022F3000-memory.dmp

Filesize
3.0MB

Download
memory/1104-71-0x00000000000C0000-0x00000000000ED000-memory.dmp

Filesize
180KB

Download
memory/1104-70-0x0000000000740000-0x0000000000786000-memory.dmp

Filesize
280KB

Download
memory/1260-78-0x0000000004420000-0x0000000004511000-memory.dmp

Filesize
964KB

Download
memory/1260-75-0x0000000006090000-0x0000000006200000-memory.dmp

Filesize
1.4MB

Download
memory/1260-74-0x0000000004420000-0x0000000004511000-memory.dmp

Filesize
964KB

Download
memory/1260-68-0x0000000006090000-0x0000000006200000-memory.dmp

Filesize
1.4MB

Download
memory/1344-61-0x00000000004012B0-mapping.dmp

Download
memory/1344-67-0x00000000000D0000-0x00000000000E0000-memory.dmp

Filesize
64KB

Download
memory/1344-66-0x0000000000B10000-0x0000000000E13000-memory.dmp

Filesize
3.0MB

Download
memory/1344-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1344-65-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1344-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1344-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1344-58-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1344-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-54-0x00000000011B0000-0x00000000011F8000-memory.dmp

Filesize
288KB

Download
memory/1424-56-0x0000000000160000-0x000000000016A000-memory.dmp

Filesize
40KB

Download
memory/1424-55-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads