Analysis
- max time kernel
129s - max time network
45s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
12/10/2022, 04:04
General
- Target SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.10978.4642.exe
- Size 850KB
- Sample221012-emxzbscda8
- SHA256 62d20f5ce8950e995b0736bb3bafedb34f3b7d95f190b3a0a1592d808f697cac
Malware Config
Extracted
-
formbook
-
mmtr
-
A2DZqKcj5ytLVZtHJA==
-
fMXPWQG+JWa0S6lZOg==
-
8kymMDxB6ShVJHxu2gshFtXY9Rw=
-
1TcOF6WxcdzplqFGcUCNkBY=
-
k3TLhZ+bOG7ahplcPA==
-
K4kL5Aq5abHNS6lZOg==
-
mXDSo9XmxlqYN6psOA==
-
m+RNCVT4shAb
-
G1kzROn+2jCug7F5psQ=
-
qNYsJkWzqwkZ
-
0BcDQuH0xt4oBh4=
-
pfRW4ZhmRsEiyvP2Mg==
-
Sqgj4eztyCg0Ezwo39iHXQ==
-
bIi2etJbcdUB
-
k2g3gBesND9hUoKOzGaVFKX6IuUaknqH1Q==
-
8dFDXQPnb4s+sWfhwoqOdgmABBK+YGg=
-
Pn9PmDzelx84EjfdzY0WkiRPz6i4
-
SrUfvOfNO3DMdLvB
-
GFXHQ9NuPdHsxOiU2umGMSiTvQE=
-
Kv9sdrhSbDfMdLvB
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.10978.4642.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.10978.4642.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.10978.4642.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.10978.4642.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/768-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/768-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/768-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/768-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/768-67-0x0000000000401000-0x000000000042F000-memory.dmp
memory/768-68-0x0000000000700000-0x0000000000A03000-memory.dmp
memory/2020-55-0x0000000075451000-0x0000000075453000-memory.dmp
memory/2020-56-0x00000000002B0000-0x00000000002CA000-memory.dmp
memory/2020-57-0x00000000004E0000-0x00000000004EC000-memory.dmp
memory/2020-58-0x0000000004F80000-0x0000000005010000-memory.dmp
memory/2020-59-0x0000000004810000-0x0000000004844000-memory.dmp
memory/2020-54-0x0000000001250000-0x000000000132A000-memory.dmp