Analysis
- max time kernel
146s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
31/03/2024, 00:40
General
- Target 489e2e06c46ad8f2a7269a677904026f_JaffaCakes118.exe
- Size 498KB
- Sample240331-a1bk2aae3z
- SHA256 f9bd74fdfb667569270dfaa42017873aed84149a633cf3fa97e8db1142bd5edd
Malware Config
Extracted
-
formbook
-
4.1
-
hht8
-
chenghuaikj.com
-
lovegames.site
-
namalon.com
-
ltxxiu.com
-
yaotiaoshiguang.top
-
serversshipping.com
-
animationwageshare.com
-
rh-et.com
-
cutepets1.com
-
chantforpeace.com
-
techmazakatta.com
-
amoorelive.com
-
bisexualnft.com
-
k5truckingexpress.com
-
6e1eturzmu9ustbnrfe2404.com
-
allday.coach
-
prettyrisque.com
-
stripeer.com
-
ktranspass.com
-
salinibros.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\489e2e06c46ad8f2a7269a677904026f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\489e2e06c46ad8f2a7269a677904026f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\489e2e06c46ad8f2a7269a677904026f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\489e2e06c46ad8f2a7269a677904026f_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1868-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1868-14-0x0000000001C40000-0x0000000001F8A000-memory.dmp
memory/3248-6-0x0000000008AD0000-0x0000000008ADE000-memory.dmp
memory/3248-3-0x0000000007830000-0x00000000078C2000-memory.dmp
memory/3248-4-0x0000000007AA0000-0x0000000007AB0000-memory.dmp
memory/3248-5-0x00000000077F0000-0x00000000077FA000-memory.dmp
memory/3248-0-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/3248-7-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/3248-8-0x0000000007AA0000-0x0000000007AB0000-memory.dmp
memory/3248-9-0x000000000C870000-0x000000000C90C000-memory.dmp
memory/3248-10-0x000000000C960000-0x000000000C9B8000-memory.dmp
memory/3248-2-0x0000000007D40000-0x00000000082E4000-memory.dmp
memory/3248-13-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/3248-1-0x00000000008D0000-0x0000000000952000-memory.dmp