formbook | de2141608c60fc5b719e73212046e8c053c99fb425970af74d606fc3dee4e440

General

Target

Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
Size

1.0MB
MD5

af4c90f16183a6ad67d309954e852c8a
SHA1

4b8612090c079bf462c55e774c7199d4f182e937
SHA256

e42dddf5106613702329f2fa39feac15baee21cd5b543d288dc82ed621eb7037
SHA512

c335c1ab1b2708530424dc094a9b864155275e4d462bf726b38338b9c33f6942c355b9092fa786bf1a20f99c7ac52b4c03e399ff5ab157fff556480db15fc823
SSDEEP

12288:0oQgKZ/nXt7virmWhlGLaQYIyzYEmgX/Lifi1SXAe73hdw7YVCiJM2dycvQ0piws:fPNNwAe7x78OQ0Hx4xUhlWp

Score

10^/10

formbook xloader m9ae loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

m9ae

Decoy

nWTQpX6TYm6dfT3Lcw==

7JaBLgMm8EKn2AlTy5Ksj4Jq

yWRJIhE3viQgqEpZS3o=

ES9dFo0bytF8vlvRcg==

aX/aBZn29pD+cg==

lU64sYOZV7ZVpUy1ag==

9BpOCYAPv8L8TyIFAiTp2PSqLg==

uEJ2RyQ1BcBXfFr8kT5Z1KV0

oVM42Ury9pD+cg==

0Zl3VkcuKaY+

OjZeGI8dw67Z6eWtnOoBfoI=

ytwFn9j4i+N8nKYRSgcfh3xn5LU=

xMb1+YkOyxmbxJ53JsP7Pg==

HODQpzTBS1gVoi4X0hStKQ==

fQ417ycwD+ziKt1u0hStKQ==

nsApOqE62sA8uS735uCXVP+YcrQ=

4aobG3oZ3AHqTPs=

P2LEwJatZbQZUTayTW0=

/bopO7NR6clCfT3Lcw==

bBxRRkFY01R+20pZS3o=

Extracted

Family

xloader

Version

3.ƅ

Campaign

m9ae

Decoy

nWTQpX6TYm6dfT3Lcw==

7JaBLgMm8EKn2AlTy5Ksj4Jq

yWRJIhE3viQgqEpZS3o=

ES9dFo0bytF8vlvRcg==

aX/aBZn29pD+cg==

lU64sYOZV7ZVpUy1ag==

9BpOCYAPv8L8TyIFAiTp2PSqLg==

uEJ2RyQ1BcBXfFr8kT5Z1KV0

oVM42Ury9pD+cg==

0Zl3VkcuKaY+

OjZeGI8dw67Z6eWtnOoBfoI=

ytwFn9j4i+N8nKYRSgcfh3xn5LU=

xMb1+YkOyxmbxJ53JsP7Pg==

HODQpzTBS1gVoi4X0hStKQ==

fQ417ycwD+ziKt1u0hStKQ==

nsApOqE62sA8uS735uCXVP+YcrQ=

4aobG3oZ3AHqTPs=

P2LEwJatZbQZUTayTW0=

/bopO7NR6clCfT3Lcw==

bBxRRkFY01R+20pZS3o=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exePayment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.execmmon32.exe

description	pid	process	target process
PID 4884 set thread context of 3144	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 3144 set thread context of 3064	3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Explorer.EXE
PID 4920 set thread context of 3064	4920	cmmon32.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cmmon32.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmmon32.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exePayment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.execmmon32.exe

pid	process
4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.execmmon32.exe

pid	process
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe
4920	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exePayment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.execmmon32.exe

description	pid	process
Token: SeDebugPrivilege	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
Token: SeDebugPrivilege	3144	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
Token: SeDebugPrivilege	4920	cmmon32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exeExplorer.EXEcmmon32.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884

C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe"
3⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe"
3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-147-0x0000000007AF0000-0x0000000007BCB000-memory.dmp

Filesize
876KB

Download
memory/3064-157-0x0000000007BD0000-0x0000000007C6F000-memory.dmp

Filesize
636KB

Download
memory/3064-155-0x0000000007BD0000-0x0000000007C6F000-memory.dmp

Filesize
636KB

Download
memory/3144-146-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Filesize
64KB

Download
memory/3144-144-0x0000000001110000-0x000000000145A000-memory.dmp

Filesize
3.3MB

Download
memory/3144-150-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/3144-138-0x0000000000000000-mapping.dmp

Download
memory/3144-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3144-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3144-142-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/3144-149-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3144-145-0x0000000000422000-0x0000000000424000-memory.dmp

Filesize
8KB

Download
memory/4784-137-0x0000000000000000-mapping.dmp

Download
memory/4884-132-0x0000000000470000-0x0000000000582000-memory.dmp

Filesize
1.1MB

Download
memory/4884-135-0x0000000005350000-0x000000000535A000-memory.dmp

Filesize
40KB

Download
memory/4884-136-0x0000000005A50000-0x0000000005AEC000-memory.dmp

Filesize
624KB

Download
memory/4884-134-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/4884-133-0x0000000005400000-0x00000000059A4000-memory.dmp

Filesize
5.6MB

Download
memory/4920-148-0x0000000000000000-mapping.dmp

Download
memory/4920-153-0x0000000003220000-0x000000000356A000-memory.dmp

Filesize
3.3MB

Download
memory/4920-154-0x00000000030D0000-0x000000000315F000-memory.dmp

Filesize
572KB

Download
memory/4920-152-0x00000000012A0000-0x00000000012CD000-memory.dmp

Filesize
180KB

Download
memory/4920-156-0x00000000012A0000-0x00000000012CD000-memory.dmp

Filesize
180KB

Download
memory/4920-151-0x00000000008D0000-0x00000000008DC000-memory.dmp

Filesize
48KB

Download

description	pid	process	target process
PID 4884 wrote to memory of 4784	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 4884 wrote to memory of 4784	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 4884 wrote to memory of 4784	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 4884 wrote to memory of 3144	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 4884 wrote to memory of 3144	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 4884 wrote to memory of 3144	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 4884 wrote to memory of 3144	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 4884 wrote to memory of 3144	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 4884 wrote to memory of 3144	4884	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe	Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130.exe
PID 3064 wrote to memory of 4920	3064	Explorer.EXE	cmmon32.exe
PID 3064 wrote to memory of 4920	3064	Explorer.EXE	cmmon32.exe
PID 3064 wrote to memory of 4920	3064	Explorer.EXE	cmmon32.exe
PID 4920 wrote to memory of 4328	4920	cmmon32.exe	Firefox.exe
PID 4920 wrote to memory of 4328	4920	cmmon32.exe	Firefox.exe
PID 4920 wrote to memory of 4328	4920	cmmon32.exe	Firefox.exe

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads