formbook | 39e1002eaf485405155f98f77b331263ab1e6fea26623dd83029f9bcc58d3c9f

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
Size

892KB
MD5

f3dcf1884dece7f98f68b8dedbc2e1c4
SHA1

5612fe2c6a400ac240ef1a40e3827120184fd8e1
SHA256

39e1002eaf485405155f98f77b331263ab1e6fea26623dd83029f9bcc58d3c9f
SHA512

d4bde77a9a218e03a71064e3aae2fd36f6b0a8e3ac3f54b78976c31153e19589d5a9bbbe0f95020623f705d889fce6ba72b5209cf0f3c26d1172e0a86da91246
SSDEEP

12288:MwDc9F3nC0Py3gAhw6ZYy8sJ90sLxvGcP+VTDaA/Ai3/CyJY1HOc/gKPW5m/iL6t:MssA90/1FaEjaTVOd5IpR9AGb

Score

10^/10

formbook mxwf rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mxwf

Decoy

orders-cialis.info

auctionorbuy.com

meanmugsamore.com

yachtcrewmark.com

sacredkashilifestudio.net

themintyard.com

bragafoods.com

sierp.com

hausofdeme.com

anthonyjames915.com

bajardepesoencasa.com

marciaroyal.com

earringlifter.com

dsdjfhd9ddksa1as.info

bmzproekt.com

employmentbc.com

ptsdtreatment.space

vrchance.com

cnrongding.com

welovelit.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2412-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

description	pid	process	target process
PID 3060 set thread context of 2412	3060	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2960 2412 WerFault.exe f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

pid	pid_target	process	target process
2960	2412	WerFault.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exef3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

description	pid	process	target process
PID 3060 wrote to memory of 2412	3060	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 3060 wrote to memory of 2412	3060	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 3060 wrote to memory of 2412	3060	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 3060 wrote to memory of 2412	3060	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 3060 wrote to memory of 2412	3060	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 3060 wrote to memory of 2412	3060	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 3060 wrote to memory of 2412	3060	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 2412 wrote to memory of 2960	2412	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	WerFault.exe
PID 2412 wrote to memory of 2960	2412	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	WerFault.exe
PID 2412 wrote to memory of 2960	2412	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	WerFault.exe
PID 2412 wrote to memory of 2960	2412	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060

C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 36
3⤵
- Program crash
PID:2960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2412-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2412-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2412-10-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3060-3-0x00000000003F0000-0x0000000000408000-memory.dmp

Filesize
96KB

Download
memory/3060-5-0x00000000006F0000-0x0000000000730000-memory.dmp

Filesize
256KB

Download
memory/3060-6-0x00000000056B0000-0x0000000005764000-memory.dmp

Filesize
720KB

Download
memory/3060-7-0x0000000002190000-0x00000000021D4000-memory.dmp

Filesize
272KB

Download
memory/3060-4-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/3060-0-0x0000000000BC0000-0x0000000000CA6000-memory.dmp

Filesize
920KB

Download
memory/3060-2-0x00000000006F0000-0x0000000000730000-memory.dmp

Filesize
256KB

Download
memory/3060-1-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/3060-14-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads