formbook | 60f13fad901db97995cd02489a30933d55850bc0aec41d5a072b3380878782ed

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2022, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Olock.1.31522.exe
Size 605KB
Sample220725-e5y94segc9
SHA256 60f13fad901db97995cd02489a30933d55850bc0aec41d5a072b3380878782ed
MD5 3545c8614b0c9578ed5d04f4366a5d1c
SHA1 04a62db9a49a51307ca4461da3f8e49d7967181c
SHA512 e4409a58997bd295a22b8e1e1a5f119a3b6720acf1dacfedeff6b38a5c84565230dc7dc5ef8165b56cd51fe4ea60938ccddce4cd3e39e1b09b326af4fec4817c
MD5 SHA1 SHA512

Score

10^/10

formbook r05y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

r05y

Decoy

rivella-beauty.com
litefimance-vi.com
midnightmadness.info
newmedstudent.com
strongbonestransformation.com
yoaza.com
darenetstats.com
markobrecic.com
pecherskikh.com
mazsoftware.net
contractorseofinder.life
vietkieu888.com
24x7account.xyz
bestfootball.club
interkeypro.com
prenuplawyerfinder.life
downloadnewsongs.com
danielnobra.com
waseetdigital.com
ozcoo.xyz
buynowpaylate.online
playyoyo.com
fjhrakqe.com
homedecoreting.com
french-stream.bet
dermatitisonface.site
authenticate-anz.com
mercado-mercado.com
retromenmusic.com
esxom.xyz
goldcalculator.guru
diplatinum.com
sophiyahlove.com
realtycenter.pro
meta-dubai.net
pecules.com
popupstoreedinburgh.com
vv12a992tslx0o7.com
tarmongolf.com
kmaxar.com
camping.coffee
mikeeppstour.com
turismophysalus.com
fl1r.com
flahertyimports.com
dnchief.com
meleklertv.com
topruouchinhhang.net
kylejbarrow.com
fitfoodcoaching.com
hispanicsarethefuture.net
1178524.xyz
premiosound.com
abreai-meulimite.net
marine.pictures
boilermakers.site
accademiadeimusici.com
genkeinakamato.art
agilemanager.pro
dirtroadmedia.online
lakepackage.site
manage-id4785-apple.com
nootkasnest.com
natureskinline.com
vicnalby.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2000-137-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 488 set thread context of 2000	488	SecuriteInfo.com.Trojan.Olock.1.31522.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	SecuriteInfo.com.Trojan.Olock.1.31522.exe
2000	SecuriteInfo.com.Trojan.Olock.1.31522.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 2000	488	SecuriteInfo.com.Trojan.Olock.1.31522.exe	85
PID 488 wrote to memory of 2000	488	SecuriteInfo.com.Trojan.Olock.1.31522.exe	85
PID 488 wrote to memory of 2000	488	SecuriteInfo.com.Trojan.Olock.1.31522.exe	85
PID 488 wrote to memory of 2000	488	SecuriteInfo.com.Trojan.Olock.1.31522.exe	85
PID 488 wrote to memory of 2000	488	SecuriteInfo.com.Trojan.Olock.1.31522.exe	85
PID 488 wrote to memory of 2000	488	SecuriteInfo.com.Trojan.Olock.1.31522.exe	85

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.31522.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.31522.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.31522.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.31522.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-130-0x0000000000C30000-0x0000000000CCE000-memory.dmp

Download

memory/488-131-0x0000000005BA0000-0x0000000006144000-memory.dmp

Download

memory/488-132-0x0000000005690000-0x0000000005722000-memory.dmp

Download

memory/488-133-0x0000000005650000-0x000000000565A000-memory.dmp

Download

memory/488-134-0x000000000ACC0000-0x000000000AD5C000-memory.dmp

Download

memory/488-135-0x000000000ADD0000-0x000000000AE36000-memory.dmp

Download

memory/2000-137-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2000-138-0x0000000001900000-0x0000000001C4A000-memory.dmp

Download