Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
02/04/2024, 09:32
General
- Target 88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe
- Size 2.0MB
- Sample240402-lhxakach21
- SHA256 0136309b04a417b48dbd312209bda252b5a9abbe7e3b39a66f53d3ab72c2eb57
Malware Config
Extracted
-
formbook
-
4.1
-
cmsr
-
dahlia-dolls.com
-
iamawife.com
-
gardunomx.com
-
roweelitetrucking.com
-
asapvk.com
-
strategieslimited.com
-
healthyweathorganics.com
-
wedding-gallery.net
-
fastoffer.online
-
biolab33.cloud
-
los40delocta.com
-
charliepaton.com
-
jenpaddock.com
-
zzmweb.com
-
poetarts.com
-
techwork4u.com
-
tracylynpropp.com
-
rkbodyfit.site
-
migaleriapanama.com
-
cosmostco.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1408-7-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1408-13-0x0000000000DB0000-0x00000000010B3000-memory.dmp
memory/1408-11-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1408-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1408-8-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2548-3-0x00000000005A0000-0x00000000005B8000-memory.dmp
memory/2548-6-0x00000000023D0000-0x0000000002426000-memory.dmp
memory/2548-5-0x00000000049B0000-0x00000000049F0000-memory.dmp
memory/2548-4-0x00000000745E0000-0x0000000074CCE000-memory.dmp
memory/2548-1-0x00000000745E0000-0x0000000074CCE000-memory.dmp
memory/2548-2-0x00000000049B0000-0x00000000049F0000-memory.dmp
memory/2548-12-0x00000000745E0000-0x0000000074CCE000-memory.dmp
memory/2548-0-0x0000000000A00000-0x0000000000C12000-memory.dmp