formbook | d5b506a06cd81e98b0ac084d04cf2eeb448dac247c0fe6570f5986c4dffd9554

Analysis

max time kernel
98s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe
Size 649KB
Sample221021-e4tcgacabn
SHA256 d5b506a06cd81e98b0ac084d04cf2eeb448dac247c0fe6570f5986c4dffd9554
MD5 fd66bd0d7e6f36fbafda1e5f874cbda4
SHA1 f4d1da7cc4d985665b7ed39699f3da088e0c35fb
SHA512 e52948d82a008d59179c2e6758694da2571e9d2cfa44ab92bac6d14a74968241d55fdfa0fdb71f8ffeecd5ad0ed62f65d4133a88b7c1a651e037b42c34df5ceb
SSDEEP 12288:QIUwFRq3NmQPMaxXSa7yYOUUNMxOso6KabnVScWNJ+tPCOf5ultQ:hC9VksC7YOUOIKabnzWutrxcQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook g1z0 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

g1z0

Decoy

americannerddaily.com
toespins.com
monicacandray.art
order9365.info
tocorap.com
artibirfestival.xyz
somopepe.africa
tallerfloral.com
designmytattoos.site
sokusup.com
oldgringoboots.store
akhilanjali.com
eutpuale.work
iconsuphanburi.com
idappiesupport.us
finprom.tech
standuppaddle.schule
traplineleatherworks.com
onestepahead.live
offwhitesales-it.com
restful.company
x456c.com
alamanatv.com
anythingpi.com
myrtyhubby.com
zahnaufhellung.pro
handbrake.space
omrishalom.space
natocons.net
arginfraworks.com
formosgb.online
infodevice1.click
fra-bok.xyz
jmstrackenco.com
ntcbrazil.com
harikyusato.com
silvahomes.shop
0neo8g.xyz
standlio.store
lionconservation.online
zkpbshop.xyz
readingpig.com
documenta-fifteen.wtf
xo3n5p-0l.net
wanxia.shop
ganhardinheiroemcasa.website
shkrepe.design
paakiwa.com
sitelerdekorasyon.com
bccteknoloji.click
thehappybalance.coach
divvyre.com
paystub1.com
xwfp3.beauty
robotrading.biz
stuffbasis.shop
ugubussu.shop
ky4071.com
benstoregame.online
andema.site
655656.xyz
jafa88.info
wyly.rest
tytg.bar
largosconcrete.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1836-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5044 set thread context of 1836	5044	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1836	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe
1836	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1836	5044	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe	89
PID 5044 wrote to memory of 1836	5044	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe	89
PID 5044 wrote to memory of 1836	5044	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe	89
PID 5044 wrote to memory of 1836	5044	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe	89
PID 5044 wrote to memory of 1836	5044	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe	89
PID 5044 wrote to memory of 1836	5044	SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe	89

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1836-140-0x00000000011B0000-0x00000000014FA000-memory.dmp

Download

memory/5044-132-0x00000000007A0000-0x0000000000848000-memory.dmp

Download

memory/5044-133-0x0000000005800000-0x0000000005DA4000-memory.dmp

Download

memory/5044-134-0x00000000052F0000-0x0000000005382000-memory.dmp

Download

memory/5044-135-0x0000000005200000-0x000000000520A000-memory.dmp

Download

memory/5044-136-0x0000000008B50000-0x0000000008BEC000-memory.dmp

Download

memory/5044-137-0x0000000008BF0000-0x0000000008C56000-memory.dmp

Download