formbook | 7c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5

General

Target

3b33c707e522fc9e706c62687387ddbc.exe
Size

336KB
MD5

3b33c707e522fc9e706c62687387ddbc
SHA1

d98eb37e12d6d7b03fd94933ab5f7dc445c67477
SHA256

7c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5
SHA512

7591fdefeff5a11fea8726d784a62229de33378f54cd27841647c53983fca87f055e40f6743bd62d7bb0493bd11b4d3a4c19529f890d924f6872d804b19c8695
SSDEEP

6144:9kwOU0Tna911TEwbdaqga1lpGC1xA67/jYUUEU6LrgJxet8ZJ8EGlu:Cf41y3ajpPA678UrU6LrgfeU8EGY

Score

10^/10

formbook xloader ctap loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

ctap

Decoy

7fuiHU5O7pBugItrXtDlRbQzVNAypQ==

Ioe4Ezkvrkk5SljtGsXC

7SdYmzWqxYzoB10eYg==

87z12VKpqmy0nXHtGsXC

frPRoZR38nhTXl/tGsXC

JybcU3xwAWn21yEPd4XnKA==

B6LTKeV3SeQZAg==

9iFOJSEVtE+I6ea4tn6M72ANGm3K

bROuHdVCVl63QIZuI2etey+ugP0=

25FDh/Be3fhaReK+BwZm9aY+og==

ipYbazKawI7oB10eYg==

Y3ONgI2GHcStmm5WhEZCsE/GlNJovg==

NMjp1U2zzpPoB10eYg==

ZZOygHxoGkBxNTz1RnI=

Hy1dkswBcyQh

94qXZbB1+8ciD4Q=

JUhyQ8Fxl+4gBA==

7wuj4eTJFutgR7+k1R8mIA==

Nj3QJ1RBulY2AMS/1R8mIA==

LjFXk8zI5vgdq8N6ropiNA==

Extracted

Family

xloader

Version

3.ƅ

Campaign

ctap

Decoy

7fuiHU5O7pBugItrXtDlRbQzVNAypQ==

Ioe4Ezkvrkk5SljtGsXC

7SdYmzWqxYzoB10eYg==

87z12VKpqmy0nXHtGsXC

frPRoZR38nhTXl/tGsXC

JybcU3xwAWn21yEPd4XnKA==

B6LTKeV3SeQZAg==

9iFOJSEVtE+I6ea4tn6M72ANGm3K

bROuHdVCVl63QIZuI2etey+ugP0=

25FDh/Be3fhaReK+BwZm9aY+og==

ipYbazKawI7oB10eYg==

Y3ONgI2GHcStmm5WhEZCsE/GlNJovg==

NMjp1U2zzpPoB10eYg==

ZZOygHxoGkBxNTz1RnI=

Hy1dkswBcyQh

94qXZbB1+8ciD4Q=

JUhyQ8Fxl+4gBA==

7wuj4eTJFutgR7+k1R8mIA==

Nj3QJ1RBulY2AMS/1R8mIA==

LjFXk8zI5vgdq8N6ropiNA==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Executes dropped EXE 2 IoCs

Processes:

pxzpa.exepxzpa.exe

pid process

2000 pxzpa.exe
996 pxzpa.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

pxzpa.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation pxzpa.exe
Loads dropped DLL 3 IoCs

Processes:

3b33c707e522fc9e706c62687387ddbc.exepxzpa.exeipconfig.exe

pid process

1292 3b33c707e522fc9e706c62687387ddbc.exe
2000 pxzpa.exe
832 ipconfig.exe

pid	process
2000	pxzpa.exe
996	pxzpa.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	pxzpa.exe

pid	process
1292	3b33c707e522fc9e706c62687387ddbc.exe
2000	pxzpa.exe
832	ipconfig.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

pxzpa.exepxzpa.exeipconfig.exe

description	pid	process	target process
PID 2000 set thread context of 996	2000	pxzpa.exe	pxzpa.exe
PID 996 set thread context of 1296	996	pxzpa.exe	Explorer.EXE
PID 996 set thread context of 1296	996	pxzpa.exe	Explorer.EXE
PID 832 set thread context of 1296	832	ipconfig.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

832 ipconfig.exe

pid	process
832	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ipconfig.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

pxzpa.exeipconfig.exe

pid	process
996	pxzpa.exe
996	pxzpa.exe
996	pxzpa.exe
996	pxzpa.exe
996	pxzpa.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

pxzpa.exepxzpa.exeipconfig.exe

pid process

2000 pxzpa.exe
996 pxzpa.exe
996 pxzpa.exe
996 pxzpa.exe
996 pxzpa.exe
832 ipconfig.exe
832 ipconfig.exe
832 ipconfig.exe
832 ipconfig.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pxzpa.exeipconfig.exe

description pid process

Token: SeDebugPrivilege 996 pxzpa.exe
Token: SeDebugPrivilege 832 ipconfig.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
1296 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
1296 Explorer.EXE

pid	process
1296	Explorer.EXE

pid	process
2000	pxzpa.exe
996	pxzpa.exe
996	pxzpa.exe
996	pxzpa.exe
996	pxzpa.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe
832	ipconfig.exe

description	pid	process
Token: SeDebugPrivilege	996	pxzpa.exe
Token: SeDebugPrivilege	832	ipconfig.exe

pid	process
1296	Explorer.EXE
1296	Explorer.EXE

pid	process
1296	Explorer.EXE
1296	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

3b33c707e522fc9e706c62687387ddbc.exepxzpa.exepxzpa.exeipconfig.exe

description	pid	process	target process
PID 1292 wrote to memory of 2000	1292	3b33c707e522fc9e706c62687387ddbc.exe	pxzpa.exe
PID 1292 wrote to memory of 2000	1292	3b33c707e522fc9e706c62687387ddbc.exe	pxzpa.exe
PID 1292 wrote to memory of 2000	1292	3b33c707e522fc9e706c62687387ddbc.exe	pxzpa.exe
PID 1292 wrote to memory of 2000	1292	3b33c707e522fc9e706c62687387ddbc.exe	pxzpa.exe
PID 2000 wrote to memory of 996	2000	pxzpa.exe	pxzpa.exe
PID 2000 wrote to memory of 996	2000	pxzpa.exe	pxzpa.exe
PID 2000 wrote to memory of 996	2000	pxzpa.exe	pxzpa.exe
PID 2000 wrote to memory of 996	2000	pxzpa.exe	pxzpa.exe
PID 2000 wrote to memory of 996	2000	pxzpa.exe	pxzpa.exe
PID 996 wrote to memory of 832	996	pxzpa.exe	ipconfig.exe
PID 996 wrote to memory of 832	996	pxzpa.exe	ipconfig.exe
PID 996 wrote to memory of 832	996	pxzpa.exe	ipconfig.exe
PID 996 wrote to memory of 832	996	pxzpa.exe	ipconfig.exe
PID 832 wrote to memory of 1884	832	ipconfig.exe	Firefox.exe
PID 832 wrote to memory of 1884	832	ipconfig.exe	Firefox.exe
PID 832 wrote to memory of 1884	832	ipconfig.exe	Firefox.exe
PID 832 wrote to memory of 1884	832	ipconfig.exe	Firefox.exe
PID 832 wrote to memory of 1884	832	ipconfig.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1296

C:\Users\Admin\AppData\Local\Temp\3b33c707e522fc9e706c62687387ddbc.exe
"C:\Users\Admin\AppData\Local\Temp\3b33c707e522fc9e706c62687387ddbc.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\pxzpa.exe
"C:\Users\Admin\AppData\Local\Temp\pxzpa.exe" C:\Users\Admin\AppData\Local\Temp\bvfschl.llo
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\pxzpa.exe
"C:\Users\Admin\AppData\Local\Temp\pxzpa.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
5⤵
PID:1204

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
5⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
6⤵
PID:1884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bvfschl.llo
Filesize
5KB

MD5
234ecaa2516da7694806821607cb957f

SHA1
5e24bc4f64658bd2c9bbfed88ca6d39d1f84f278

SHA256
4559491a1389e02acd69695203a90b6692df27d34a3095ba7f4f753562754f56

SHA512
1a0fb05636f903ea3b583ec022b3d1182ee7c7a872abfc99822b633cb7bb2a305200406093430e308ecaaba28b5ed2ed84223812962863592d4d2cd399b18f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\puacwrlc.q
Filesize
185KB

MD5
ae560924ece971bea500b39cf812665d

SHA1
db73b123c1edb1cde8925d784f1f793aacf26f6e

SHA256
176f6aaf297901b7100ab3164b6229042dc858876c48c04b7efeef2e71798176

SHA512
67fdbe987fa13481daccc6432034ddf4a33f1033a469adbfa347d8361a9290e5dcb183a45085486ef90d1409f991494c26902d85c1c8bf29ee98753dcbb1a8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\pxzpa.exe
Filesize
281KB

MD5
ca0cca1b24cac955c84585eeefab6944

SHA1
517916bf6278c0584e8c50e2deeb5d75c67a413b

SHA256
aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585

SHA512
28194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488

Download Submit
C:\Users\Admin\AppData\Local\Temp\pxzpa.exe
Filesize
281KB

MD5
ca0cca1b24cac955c84585eeefab6944

SHA1
517916bf6278c0584e8c50e2deeb5d75c67a413b

SHA256
aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585

SHA512
28194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488

Download Submit
C:\Users\Admin\AppData\Local\Temp\pxzpa.exe
Filesize
281KB

MD5
ca0cca1b24cac955c84585eeefab6944

SHA1
517916bf6278c0584e8c50e2deeb5d75c67a413b

SHA256
aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585

SHA512
28194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488

Download Submit
\Users\Admin\AppData\Local\Temp\pxzpa.exe
Filesize
281KB

MD5
ca0cca1b24cac955c84585eeefab6944

SHA1
517916bf6278c0584e8c50e2deeb5d75c67a413b

SHA256
aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585

SHA512
28194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488

Download Submit
\Users\Admin\AppData\Local\Temp\pxzpa.exe
Filesize
281KB

MD5
ca0cca1b24cac955c84585eeefab6944

SHA1
517916bf6278c0584e8c50e2deeb5d75c67a413b

SHA256
aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585

SHA512
28194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll
Filesize
895KB

MD5
1eb6acf76a15b74b38333af47dc1218d

SHA1
a3fbc817f59b6a8899dc338cc15a75cdd17dfff1

SHA256
a5ef3a78eb333b0e6dca194ea711dcbb036119a788ecfe125f05176fb0fb70a3

SHA512
717931aa928de150abbb70d523c7dbd472bfa6c511ab55e0b50df8d9661d33635156ed7b750285fa383cdd4064f225ea022f0bead3e066ee2beba84ef5731c15

Download Submit
memory/832-77-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/832-78-0x0000000000BB0000-0x0000000000EB3000-memory.dmp

Filesize
3.0MB

Download
memory/832-76-0x0000000000FB0000-0x0000000000FBA000-memory.dmp

Filesize
40KB

Download
memory/832-74-0x0000000000000000-mapping.dmp

Download
memory/832-79-0x0000000000970000-0x00000000009FF000-memory.dmp

Filesize
572KB

Download
memory/832-81-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/996-70-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/996-68-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/996-67-0x0000000000880000-0x0000000000B83000-memory.dmp

Filesize
3.0MB

Download
memory/996-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/996-73-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/996-66-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/996-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/996-63-0x00000000004012B0-mapping.dmp

Download
memory/1292-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1296-71-0x0000000006B60000-0x0000000006CAD000-memory.dmp

Filesize
1.3MB

Download
memory/1296-80-0x0000000006CB0000-0x0000000006E35000-memory.dmp

Filesize
1.5MB

Download
memory/1296-69-0x0000000004ED0000-0x0000000005025000-memory.dmp

Filesize
1.3MB

Download
memory/1296-82-0x0000000006CB0000-0x0000000006E35000-memory.dmp

Filesize
1.5MB

Download
memory/2000-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads