Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 22:31
General
- Target a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe
- Size 543KB
- Sample240403-2fva7aeg5x
- SHA256 b877e6f41d83c546f056fa7f88b5f323d944616a9919025e71971d034b56b592
Malware Config
Extracted
-
formbook
-
4.1
-
fzsg
-
thewetpatch.wtf
-
oceanfrontrecords.com
-
ultimatemecha.com
-
domainnameshq.com
-
schieksrvservice.com
-
bedandbreakfastitalia.cloud
-
rfmlc.com
-
hightechvids.com
-
greenvilledermotolgy.com
-
psilocybinforu.com
-
xjkerwen.com
-
euro-d-rev.com
-
shans-online.com
-
masterofcrypto.com
-
gamodaitaliana.online
-
lavivabet217.com
-
femsol.online
-
qafyzey.site
-
kang17.xyz
-
kilimlove.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a86dedf95d0d7a02c577ea6333686a47_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2892-6-0x0000000006EC0000-0x0000000006ECA000-memory.dmp
memory/2892-10-0x0000000006FF0000-0x000000000706C000-memory.dmp
memory/2892-2-0x0000000005C40000-0x00000000061E4000-memory.dmp
memory/2892-3-0x00000000055E0000-0x0000000005672000-memory.dmp
memory/2892-4-0x0000000005880000-0x0000000005890000-memory.dmp
memory/2892-5-0x00000000057A0000-0x00000000057AA000-memory.dmp
memory/2892-1-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/2892-8-0x0000000005880000-0x0000000005890000-memory.dmp
memory/2892-0-0x0000000000BD0000-0x0000000000C5E000-memory.dmp
memory/2892-9-0x0000000006ED0000-0x0000000006F6C000-memory.dmp
memory/2892-7-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/2892-13-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/3420-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3420-14-0x0000000001760000-0x0000000001AAA000-memory.dmp
memory/3420-15-0x0000000001760000-0x0000000001AAA000-memory.dmp