formbook | 51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
Size

531KB
MD5

0485b82d63f7ad0fcf8fb8cad375d27c
SHA1

cd5a1c7eac16d6de771d82aafc0b88d3446dcd51
SHA256

51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e
SHA512

b18d8513051ba56a4e3a0b8fdf0ade811ea0fe7636cd1d910f0c6bfad8def2c8062f5aa360ff48f8ecdc8534885accc510d98e67d6e7443f178e23549e608a98
SSDEEP

12288:dMTWwo00fX2qu4YENqlj4aYbwAA1dju0WEIdRBCQaPOonyLQSB:dio00PW4DUwEAA1qDBCQsOo0B

Score

10^/10

formbook mxwf rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mxwf

Decoy

orders-cialis.info

auctionorbuy.com

meanmugsamore.com

yachtcrewmark.com

sacredkashilifestudio.net

themintyard.com

bragafoods.com

sierp.com

hausofdeme.com

anthonyjames915.com

bajardepesoencasa.com

marciaroyal.com

earringlifter.com

dsdjfhd9ddksa1as.info

bmzproekt.com

employmentbc.com

ptsdtreatment.space

vrchance.com

cnrongding.com

welovelit.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1040-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

description	pid	process	target process
PID 3148 set thread context of 1040	3148	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

pid process

1040 0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
1040 0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

pid	process
1040	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
1040	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

description	pid	process	target process
PID 3148 wrote to memory of 1040	3148	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 3148 wrote to memory of 1040	3148	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 3148 wrote to memory of 1040	3148	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 3148 wrote to memory of 1040	3148	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 3148 wrote to memory of 1040	3148	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
PID 3148 wrote to memory of 1040	3148	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe	0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148

C:\Users\Admin\AppData\Local\Temp\0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0485b82d63f7ad0fcf8fb8cad375d27c_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1040-14-0x0000000001B00000-0x0000000001E4A000-memory.dmp

Filesize
3.3MB

Download
memory/3148-6-0x0000000006370000-0x000000000637A000-memory.dmp

Filesize
40KB

Download
memory/3148-3-0x0000000004AC0000-0x0000000004B52000-memory.dmp

Filesize
584KB

Download
memory/3148-4-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/3148-5-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Filesize
40KB

Download
memory/3148-0-0x0000000000080000-0x000000000010C000-memory.dmp

Filesize
560KB

Download
memory/3148-7-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/3148-8-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/3148-9-0x0000000006380000-0x000000000641C000-memory.dmp

Filesize
624KB

Download
memory/3148-10-0x00000000064A0000-0x0000000006518000-memory.dmp

Filesize
480KB

Download
memory/3148-2-0x0000000005070000-0x0000000005614000-memory.dmp

Filesize
5.6MB

Download
memory/3148-13-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/3148-1-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download