Analysis
- max time kernel
120s - max time network
124s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
03/04/2024, 22:31
General
- Target a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe
- Size 543KB
- Sample240403-2fva7aeg5x
- SHA256 b877e6f41d83c546f056fa7f88b5f323d944616a9919025e71971d034b56b592
Malware Config
Extracted
-
formbook
-
4.1
-
fzsg
-
thewetpatch.wtf
-
oceanfrontrecords.com
-
ultimatemecha.com
-
domainnameshq.com
-
schieksrvservice.com
-
bedandbreakfastitalia.cloud
-
rfmlc.com
-
hightechvids.com
-
greenvilledermotolgy.com
-
psilocybinforu.com
-
xjkerwen.com
-
euro-d-rev.com
-
shans-online.com
-
masterofcrypto.com
-
gamodaitaliana.online
-
lavivabet217.com
-
femsol.online
-
qafyzey.site
-
kang17.xyz
-
kilimlove.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2604-7-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2604-15-0x0000000000AA0000-0x0000000000DA3000-memory.dmp
memory/2604-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2604-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2604-9-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2956-3-0x00000000004B0000-0x00000000004BA000-memory.dmp
memory/2956-6-0x0000000005740000-0x00000000057BC000-memory.dmp
memory/2956-5-0x0000000004D70000-0x0000000004DB0000-memory.dmp
memory/2956-4-0x0000000073CB0000-0x000000007439E000-memory.dmp
memory/2956-0-0x0000000000130000-0x00000000001BE000-memory.dmp
memory/2956-2-0x0000000004D70000-0x0000000004DB0000-memory.dmp
memory/2956-14-0x0000000073CB0000-0x000000007439E000-memory.dmp
memory/2956-1-0x0000000073CB0000-0x000000007439E000-memory.dmp