formbook | 0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34

General

Target

0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
Size

918KB
MD5

0a345135b404efdd0884368a3c68bae4
SHA1

d74d76b39993a2555a06727f769463bb538b1484
SHA256

0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34
SHA512

1fca159141ed11357fe24c506a7066135ad59b4f8c6b5763d0a82ff3138ae84f10aeec494dc203cbe92f4f9f8036eb9c42e8ca5456ebca98f3d4df8e92d59268
SSDEEP

12288:0SZMrD2ZT3p6nLmoXKtzZ78+xmH/aJIiV5jlR:XBUnstd78+wHYF

Score

10^/10

formbook xloader roz2 loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

roz2

Decoy

jTSEx/DqnWrhnUQ0UQ==

+8219xzGmr2teTrY+fSBK+NOiLc=

/6YHkqNBJiBHvzaT9f2W

56INgrlbOqaBFx2UX/U=

g0J6uduFMzkyC89A1m8MyELra5CYkg==

WAvnVEtqSgNq4NWIGAXQDw==

rlIzjaLSfvwnMJi2

hfKU4ncqea/ITgg=

YNFrxuPv2d1k/QOeQJqGeyg=

t0g0iJ7Nd90i20hzLkEVRcDa

1FRIgZcmCDwh9ACnP5qGeyg=

DgycCCcM7dZP0NaJOpqGeyg=

Hv2jETNeVgEnMJi2

iQT+U40uH2BeEMBvoaNh2I7D

B47/RHqHdm7inUQ0UQ==

HNWL4RdJKOonMJi2

E42gATYJ7NxBxcCv01T/Y925Vnt0

P/rfWIvXyITjrXNcBASU

3pfoX4MmDD0TnTKT9f2W

YevnQ1Wrj/z3k04K1GUjjiA=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1756-64-0x0000000000420280-mapping.dmp	xloader
behavioral1/memory/1756-63-0x0000000000400000-0x000000000042D000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

description	pid	process	target process
PID 976 set thread context of 1756	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

pid	process
976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
1756	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

description pid process

Token: SeDebugPrivilege 976 0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

description	pid	process
Token: SeDebugPrivilege	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

description	pid	process	target process
PID 976 wrote to memory of 1120	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1120	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1120	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1120	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1756	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1756	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1756	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1756	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1756	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1756	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
PID 976 wrote to memory of 1756	976	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe	0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe

C:\Users\Admin\AppData\Local\Temp\0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
"C:\Users\Admin\AppData\Local\Temp\0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\AppData\Local\Temp\0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
"C:\Users\Admin\AppData\Local\Temp\0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe"
2⤵
PID:1120

C:\Users\Admin\AppData\Local\Temp\0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe
"C:\Users\Admin\AppData\Local\Temp\0c4ba49409a1657eb9d7fb2aadb86c0653ee9760fca291b58f9e7cc25d69ab34.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-54-0x0000000000B50000-0x0000000000C3C000-memory.dmp

Filesize
944KB

Download
memory/976-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/976-56-0x0000000000480000-0x000000000049A000-memory.dmp

Filesize
104KB

Download
memory/976-57-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/976-58-0x0000000007D00000-0x0000000007D8C000-memory.dmp

Filesize
560KB

Download
memory/976-59-0x0000000004220000-0x0000000004252000-memory.dmp

Filesize
200KB

Download
memory/1756-60-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1756-61-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1756-64-0x0000000000420280-mapping.dmp

Download
memory/1756-63-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1756-65-0x0000000000C40000-0x0000000000F43000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads