Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 04:02
General
- Target 9f95195d65c34c3b3bc599e399196cbb_JaffaCakes118.exe
- Size 460KB
- Sample240403-el8pfafe4s
- SHA256 efbfd17d24ef5ee8e54a74ef9527396d511bcdade1826a1c08ee4f2603ec798e
Malware Config
Extracted
-
formbook
-
4.1
-
useb
-
houseofbooksae.net
-
ipjfeugo.xyz
-
sandiegowavefc.store
-
kamerynemehiel.com
-
herbalhealthalert.com
-
nfmedco.com
-
dorhop.com
-
bookingscenter.com
-
blaclyteproductions.com
-
novatel-network.com
-
locomotionprogramming.com
-
dotchocolatebars.com
-
rohanyat.online
-
a2detail.com
-
cotedazurpropertyforsale.com
-
space-vantage.space
-
averysanswers.com
-
lionheartimagery.com
-
nozincwadi.com
-
lovemyduck.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f95195d65c34c3b3bc599e399196cbb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9f95195d65c34c3b3bc599e399196cbb_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9f95195d65c34c3b3bc599e399196cbb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9f95195d65c34c3b3bc599e399196cbb_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1276-6-0x00000000051A0000-0x00000000051AA000-memory.dmp
memory/1276-10-0x0000000006170000-0x00000000061C8000-memory.dmp
memory/1276-2-0x00000000056D0000-0x0000000005C74000-memory.dmp
memory/1276-3-0x00000000051C0000-0x0000000005252000-memory.dmp
memory/1276-4-0x00000000053F0000-0x0000000005400000-memory.dmp
memory/1276-5-0x0000000005170000-0x000000000517A000-memory.dmp
memory/1276-0-0x0000000000730000-0x00000000007A8000-memory.dmp
memory/1276-8-0x00000000053F0000-0x0000000005400000-memory.dmp
memory/1276-1-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1276-9-0x0000000005F80000-0x000000000601C000-memory.dmp
memory/1276-7-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1276-13-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/4948-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4948-14-0x0000000001AB0000-0x0000000001DFA000-memory.dmp
memory/4948-15-0x0000000001AB0000-0x0000000001DFA000-memory.dmp