formbook | 9b6b00b331ea48d5477fbd0ec6e168407dcec59c758eb797c9672d2f74dba12a

General

Target

c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
Size

448KB
MD5

c78d5e89ebecb4d88d3ab36bc47fd7ba
SHA1

476733e0eb88a9dce2a65200c23ddd0d5f2b3496
SHA256

9b6b00b331ea48d5477fbd0ec6e168407dcec59c758eb797c9672d2f74dba12a
SHA512

a4de582e5f599ad11c60dbdb7e7ded18c004f956ec84eb379f30ebd1e83eb3fe938fab821038dcf6c1dff839b329ff85ab556fd75f54e70e332ff25415ddfddb
SSDEEP

12288:sJaathSy/zUhnXh1ToH4qRhTp2e3l9hradP7P:sJGy/4Ds4wEe31adP

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/864-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

description	pid	process	target process
PID 3320 set thread context of 864	3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exec78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

pid	process
3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
864	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
864	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
864	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3320 c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

description	pid	process	target process
PID 3320 wrote to memory of 864	3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
PID 3320 wrote to memory of 864	3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
PID 3320 wrote to memory of 864	3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
PID 3320 wrote to memory of 864	3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
PID 3320 wrote to memory of 864	3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
PID 3320 wrote to memory of 864	3320	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe	c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320

C:\Users\Admin\AppData\Local\Temp\c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c78d5e89ebecb4d88d3ab36bc47fd7ba_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8
1⤵
PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/864-15-0x00000000012A0000-0x00000000015EA000-memory.dmp

Filesize
3.3MB

Download
memory/864-14-0x00000000012A0000-0x00000000015EA000-memory.dmp

Filesize
3.3MB

Download
memory/3320-6-0x0000000007760000-0x000000000776E000-memory.dmp

Filesize
56KB

Download
memory/3320-4-0x0000000007710000-0x0000000007720000-memory.dmp

Filesize
64KB

Download
memory/3320-5-0x0000000007670000-0x000000000767A000-memory.dmp

Filesize
40KB

Download
memory/3320-0-0x00000000006C0000-0x0000000000736000-memory.dmp

Filesize
472KB

Download
memory/3320-7-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/3320-8-0x0000000007710000-0x0000000007720000-memory.dmp

Filesize
64KB

Download
memory/3320-9-0x000000000A0C0000-0x000000000A15C000-memory.dmp

Filesize
624KB

Download
memory/3320-10-0x000000000A250000-0x000000000A2A6000-memory.dmp

Filesize
344KB

Download
memory/3320-3-0x00000000075B0000-0x0000000007642000-memory.dmp

Filesize
584KB

Download
memory/3320-13-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/3320-2-0x0000000007A60000-0x0000000008004000-memory.dmp

Filesize
5.6MB

Download
memory/3320-1-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads