Formbook XLoader: A Fake Order That Hides Inside a Windows Process

A Formbook XLoader campaign hides inside a signed Windows process: an order-themed ZIP starts a script chain that hollows the malware into aspnet_compiler.exe, so the thief runs under a trusted name while it reads saved browser logins.

Process hollowing means starting a legitimate program in a suspended state, emptying its memory and loading attacker code in its place. The process still carries the legitimate name, which is why a defence that trusts process names has nothing to flag. Formbook, also sold as XLoader, is an infostealer that has been sold as a service since 2016.

Analysis based on ANY.RUN research published on 10 November 2026. The same malware family has hit the same part of Europe before: Infosecurity Magazine reported earlier Formbook campaigns against Greece, Spain, Slovenia, Bosnia and Croatia in April 2026. Threat Watch has also covered order emails that pass DMARC.

How does Formbook XLoader hide inside aspnet_compiler.exe?

ANY.RUN describes one chain from the ZIP to the stolen data. Steps 1 to 3 are the delivery and the loader; steps 4 to 6 are the injection, the watchdog and the theft.

1. An employee in procurement or finance receives a message with a ZIP attachment named like a routine business document. The analysed archive, Nova narudžba 0148-712.zip, carries a Croatian name for "new order" and holds a JavaScript file of the same name.
2. Opening the script runs about 2 MB of obfuscated JavaScript. It decodes an embedded PowerShell payload, writes it to a randomly named file under C:\Temp\ (or %TEMP% as a fallback) and starts it with hidden, non-interactive flags. A WMI check kills the process if it runs longer than 50 seconds.
3. The PowerShell stage, headed "PowerShell Modular AES Pipeline Loader", decrypts the next stage and runs it in memory. It then clears its resource map and forces garbage collection to leave less for disk-based analysis.
4. The decrypted stage holds a .NET injector named GHOST.dll, protected with ConfuserEx, and the Formbook payload. The injector hollows Formbook into aspnet_compiler.exe, a legitimate Windows utility.
5. The watchdog, Operate-Beacon, checks every five seconds that the hollowed process is still running and reloads GHOST.dll if it is not. Analysts saw 15 launches of aspnet_compiler.exe in one session.
6. Formbook then moves into rekeywiz.exe, a legitimate Windows EFS utility, launches Firefox and creates a randomly named file in %TEMP%, which the researchers say is consistent with collecting browser databases before reading them. It contacts two command domains.

What a defender sees at each stage

The table lists the process name at each step and why a name check alone does not help. It is AegisAI's reading of the reported chain.

The reported timeline

How do I detect Formbook process hollowing in aspnet_compiler.exe?

Detect the chain, not the file name. ANY.RUN's guidance is to examine parent processes, command-line arguments, execution context and memory behaviour instead of relying on process names, and to correlate several indicators, for example hidden PowerShell launched by wscript.exe, rather than a single filename.

Four signals from the report make workable hunting rules:

• wscript.exe starting a hidden PowerShell instance that runs a randomly named script from C:\Temp\, with the flags -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo.
• Repeated launches of aspnet_compiler.exe, which the researchers saw 15 times in one session, with a parent that is not a build tool.
• rekeywiz.exe starting a browser. AegisAI's reading is that a utility for encrypting files has no reason to do so.
• Run key values or Startup shortcuts that match SystemUpdate_ps_*.

On the network side, the command domains are the better indicator. One of the three associated IP addresses sits on shared hosting, so the researchers prefer domain-based detection to blocking the IP address alone. The traffic also carries a user-agent string that claims to be an Android 4.1.1 tablet while the host runs Windows, which makes an outbound proxy rule possible.

What this means for a security team

This section is AegisAI's analysis. The researchers name manufacturing and technology companies as especially exposed, because employees there handle purchase orders, supplier documents and payment requests every day. Any organization with a procurement or finance desk has the same exposure, and Formbook's reach is wider than one campaign: the same family appeared in the April reporting with different loaders and different archives.

Three questions settle the exposure: whether script files such as .js open with the Windows script host on staff machines, whether endpoint detection covers parent and child process relationships rather than names, and whether credentials saved in browsers can be reset quickly for a user who opened the archive.

Why standard controls miss it

This section is AegisAI's analysis. Controls that key on process names have nothing to object to, because wscript.exe, PowerShell, aspnet_compiler.exe and rekeywiz.exe all belong to Windows. Controls that scan files meet obfuscation built for exactly that, and an encrypted second stage that never reaches disk in readable form. The remaining signals are context: who started the process, with which arguments, and what it then did. Before any of that, the attack is a message. A business document in the recipient's language that holds a script file is a request to open it, and that request is visible when the email arrives.

How AegisAI protects against it

AegisAI has not observed this campaign. ANY.RUN reports that the archive arrived as an email attachment, so the approach below is how AegisAI treats a lure of this shape when it arrives by email. It does not cover what happens on an endpoint after the script runs.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.

When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.

See an order lure like this investigated How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• Block script attachments such as .js inside ZIP files at the mail layer where there is no business need, and set the default handler for .js on staff machines to a text editor rather than the Windows script host.
• Add detections for wscript.exe starting hidden PowerShell with execution-policy bypass, and for aspnet_compiler.exe or rekeywiz.exe launched by an unexpected parent, started repeatedly or opening network connections.
• Hunt for Run key values and Startup shortcuts matching SystemUpdate_ps_*, and detect the two command domains in proxy and DNS logs instead of blocking the shared IP address.
• Brief procurement and finance staff that order, price-list and bank-transfer documents arrive in many languages, and that a script file inside an archive is never an order.
• Where a user opened the archive, isolate the host, then treat browser-saved credentials as exposed: reset them and review the accounts they unlock.

FAQ