formbook | 59202d95bbcb9a85624ae56b93adeecc94b476a0131fe4670b718439ae4da1c9

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/04/2024, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe
Size 260KB
Sample240403-bhz2cabc3t
SHA256 59202d95bbcb9a85624ae56b93adeecc94b476a0131fe4670b718439ae4da1c9
MD5 9c05d1ae12cc58702c8a54ad739b9551
SHA1 4f2435a19956ebbe4acd214c65428a36337f7abd
SHA512 10c9ae58247631a80f9afdcd688684bd7e81be8cf059e1bb85d55cb43737197fcbc19a9f82806fb059c948b59dd6abac588b5e04a072c67f722b852ab6e9f4f1
SSDEEP 6144:F8LxBsOIdSIHJKM7xTTGYsmLMJKsYTwnXfK8fJV4:/OKlgVmcYMnXfp4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

dn7r

Decoy

eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
crosschain.services
xiwanghe.com
mollycayton.com
bonipay.com
uuwyxc.com
viberiokno-online.com
mobceo.com
menzelna.com
tiffaniefoster.com
premiumautowesthartford.com
ownhome.house
bestmartinshop.com
splashstoreofficial.com
guidemining.com
ecshopdemo.com
bestprinting1.com
s-circle2020.com
ncagency.info
easydigitalzone.com
reikiforthecollective.com
theknottteam.com
evolvedpixel.com
japxo.online
ryansqualityrenovations.com
dentimagenquito.net
pantherprints.co.uk
apoporangi.com
thietkemietvuon.net
ifernshop.com
casaruralesgranada.com
camp-3saumons.com
eddsucks.com
blwcd.com
deldlab.com
susanperb.com
autosanitizingsolutions.com
femhouse.com
ironcageclash.com
thekinghealer.com
shaghayeghbovand.com
advertfaces.com
lonriley.com
mased-world.online
mythicspacex.com
yourherogarden.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/3048-9-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

pid	Process
1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 3048	1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3048	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3048	1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe	28
PID 1988 wrote to memory of 3048	1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe	28
PID 1988 wrote to memory of 3048	1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe	28
PID 1988 wrote to memory of 3048	1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe	28
PID 1988 wrote to memory of 3048	1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe	28
PID 1988 wrote to memory of 3048	1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe	28
PID 1988 wrote to memory of 3048	1988	9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9c05d1ae12cc58702c8a54ad739b9551_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqxq.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi39F5.tmp\sqxq.dll
Size 27KB
SHA256 afa62df6a2905e93ab1f59b5bd24856a88f735cd3930e7701a22a1988d3d475c
MD5 3d2e7f16f238ac79b3d0e21a753ae79e
SHA1 ee53d37f5f1a86ddb7e1b6faa063d4afbabcf771
SHA512 e9764e730f2b3eea3d769649164a41f10b8e0be865e8a76ba65220b20d8b122bb6dad1a2be8b87fe861960eecfb11b9f836ac93d17fcb218c0201d6a17545ea5
SSDEEP 768:1oFOzbc9RWl6YOFbzdAk3anbKgPSUm6At0wvM1W:6UbUWl0aUaVAN0wvIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1988-7-0x0000000074380000-0x000000007438A000-memory.dmp

Download

memory/1988-10-0x0000000074380000-0x000000007438A000-memory.dmp

Download

memory/3048-9-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3048-12-0x0000000000700000-0x0000000000A03000-memory.dmp

Download