formbook | b673ccbb584d0c5bc0f052883d2235b6eec5a68cb7c8c78c3b6faf6be863de3d

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe
Size 848KB
Sample221012-emxzbscdcj
SHA256 b673ccbb584d0c5bc0f052883d2235b6eec5a68cb7c8c78c3b6faf6be863de3d
MD5 555da0f04382498ce84f5a61866c8ae7
SHA1 21cd420fd30f03c5ce7eac09566a41ba87d0bedb
SHA512 28075d9223ea1f660c7fec23bc674f283cb74a0b21af38bc387a720822fe932fc2273b06cd4f5f8c287a367a0cefe2be3ec66c6d22c3463fd7c7d572474492df
SSDEEP 12288:Pp/kiRuEjpEnHglVpcy+s2Ac/68WTkSoe6IEWiGIgTBtRuhkVbdKzq:ac0o7chJCTjz6IEWiGBBtRJ+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook g28p rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

g28p

Decoy

whhmgs.asia
wellmedcaredirect.net
beggarded.com
wtpjiv.site
todo-celulares.com
parkitny.net
43345.top
pro-genie.com
cwdxz.com
cbc-inc.xyz
healthspots.net
rulil.top
pyramidaudit.solutions
k8sb15.live
hempaware.report
usclink.life
stayefs.net
05262.top
shop-izakaya-jin.com
iccworldcupnews.com
lulamail.xyz
dubaistocks.club
royaleyeandearhospital.com
cash-date.biz
hbfcjgj.com
zcx625.fun
compra-venta-autos.online
waltherchen.xyz
asyimpo.xyz
gayxxxporn.info
xn--igvy44d.xn--55qx5d
teaktime.net
aydesign.xyz
hfamq.site
tunayreklam.net
rxof.rest
naturebody.love
elijahelijah.com
lojasiadis.com
amazrsxrszwna.com
realtranzex.com
elelfo3d.fun
fse.community
28369.xyz
minigolfauthority.net
venturebestdeals.click
robeholidayrentals.store
edarva.skin
xikixvtj.work
ecolabspeyua.store
infidelitytoolkit.com
crawfordbayoysterroast.net
adenongel.dentist
appliancegrey.site
ky7769.com
kshd.xyz
ausbonusbets.com
aks.capital
rv8288.xyz
retetelebunicii.com
younginheart.net
ps4controller.net
todotutoriales10.com
boletosdeavionbaratos.com
spartanburgwebdesign.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4712-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4724 set thread context of 4712	4724	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4712	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe
4712	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4712	4724	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe	92
PID 4724 wrote to memory of 4712	4724	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe	92
PID 4724 wrote to memory of 4712	4724	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe	92
PID 4724 wrote to memory of 4712	4724	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe	92
PID 4724 wrote to memory of 4712	4724	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe	92
PID 4724 wrote to memory of 4712	4724	SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe	92

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4712-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4712-141-0x0000000001680000-0x00000000019CA000-memory.dmp

Download

memory/4724-132-0x0000000000800000-0x00000000008D8000-memory.dmp

Download

memory/4724-133-0x0000000005970000-0x0000000005F14000-memory.dmp

Download

memory/4724-134-0x00000000052B0000-0x0000000005342000-memory.dmp

Download

memory/4724-135-0x0000000006540000-0x0000000006B58000-memory.dmp

Download

memory/4724-136-0x0000000005360000-0x000000000536A000-memory.dmp

Download

memory/4724-137-0x000000000A710000-0x000000000A7AC000-memory.dmp

Download

memory/4724-138-0x000000000A7B0000-0x000000000A816000-memory.dmp

Download