formbook | 51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
Size

531KB
MD5

0485b82d63f7ad0fcf8fb8cad375d27c
SHA1

cd5a1c7eac16d6de771d82aafc0b88d3446dcd51
SHA256

51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e
SHA512

b18d8513051ba56a4e3a0b8fdf0ade811ea0fe7636cd1d910f0c6bfad8def2c8062f5aa360ff48f8ecdc8534885accc510d98e67d6e7443f178e23549e608a98
SSDEEP

12288:dMTWwo00fX2qu4YENqlj4aYbwAA1dju0WEIdRBCQaPOonyLQSB:dio00PW4DUwEAA1qDBCQsOo0B

Score

10^/10

formbook mxwf rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mxwf

Decoy

orders-cialis.info

auctionorbuy.com

meanmugsamore.com

yachtcrewmark.com

sacredkashilifestudio.net

themintyard.com

bragafoods.com

sierp.com

hausofdeme.com

anthonyjames915.com

bajardepesoencasa.com

marciaroyal.com

earringlifter.com

dsdjfhd9ddksa1as.info

bmzproekt.com

employmentbc.com

ptsdtreatment.space

vrchance.com

cnrongding.com

welovelit.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2604-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

description	pid	process	target process
PID 2292 set thread context of 2604	2292	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

pid process

2604 0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

pid	process
2604	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

description	pid	process	target process
PID 2292 wrote to memory of 2604	2292	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 2292 wrote to memory of 2604	2292	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 2292 wrote to memory of 2604	2292	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 2292 wrote to memory of 2604	2292	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 2292 wrote to memory of 2604	2292	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 2292 wrote to memory of 2604	2292	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 2292 wrote to memory of 2604	2292	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292

C:\Users\Admin\AppData\Local\Temp\0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-6-0x0000000002270000-0x00000000022E8000-memory.dmp

Filesize
480KB

Download
memory/2292-1-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-2-0x0000000004E80000-0x0000000004EC0000-memory.dmp

Filesize
256KB

Download
memory/2292-3-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/2292-4-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-5-0x0000000004E80000-0x0000000004EC0000-memory.dmp

Filesize
256KB

Download
memory/2292-0-0x0000000000890000-0x000000000091C000-memory.dmp

Filesize
560KB

Download
memory/2292-14-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2604-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2604-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2604-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2604-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2604-15-0x0000000000AB0000-0x0000000000DB3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads