formbook | 39e1002eaf485405155f98f77b331263ab1e6fea26623dd83029f9bcc58d3c9f

General

Target

f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
Size

892KB
MD5

f3dcf1884dece7f98f68b8dedbc2e1c4
SHA1

5612fe2c6a400ac240ef1a40e3827120184fd8e1
SHA256

39e1002eaf485405155f98f77b331263ab1e6fea26623dd83029f9bcc58d3c9f
SHA512

d4bde77a9a218e03a71064e3aae2fd36f6b0a8e3ac3f54b78976c31153e19589d5a9bbbe0f95020623f705d889fce6ba72b5209cf0f3c26d1172e0a86da91246
SSDEEP

12288:MwDc9F3nC0Py3gAhw6ZYy8sJ90sLxvGcP+VTDaA/Ai3/CyJY1HOc/gKPW5m/iL6t:MssA90/1FaEjaTVOd5IpR9AGb

Score

10^/10

formbook mxwf rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mxwf

Decoy

orders-cialis.info

auctionorbuy.com

meanmugsamore.com

yachtcrewmark.com

sacredkashilifestudio.net

themintyard.com

bragafoods.com

sierp.com

hausofdeme.com

anthonyjames915.com

bajardepesoencasa.com

marciaroyal.com

earringlifter.com

dsdjfhd9ddksa1as.info

bmzproekt.com

employmentbc.com

ptsdtreatment.space

vrchance.com

cnrongding.com

welovelit.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1200-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

description	pid	process	target process
PID 1312 set thread context of 1200	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exef3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

pid	process
1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
1200	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
1200	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1312 f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

description	pid	process	target process
PID 1312 wrote to memory of 372	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 1312 wrote to memory of 372	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 1312 wrote to memory of 372	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 1312 wrote to memory of 1200	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 1312 wrote to memory of 1200	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 1312 wrote to memory of 1200	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 1312 wrote to memory of 1200	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 1312 wrote to memory of 1200	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
PID 1312 wrote to memory of 1200	1312	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe	f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe"
2⤵
PID:372

C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3dcf1884dece7f98f68b8dedbc2e1c4_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1200-15-0x0000000001550000-0x000000000189A000-memory.dmp

Filesize
3.3MB

Download
memory/1312-6-0x0000000005AB0000-0x0000000005B4C000-memory.dmp

Filesize
624KB

Download
memory/1312-3-0x0000000005730000-0x00000000057C2000-memory.dmp

Filesize
584KB

Download
memory/1312-4-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/1312-5-0x0000000005900000-0x000000000590A000-memory.dmp

Filesize
40KB

Download
memory/1312-0-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/1312-7-0x0000000005A30000-0x0000000005A48000-memory.dmp

Filesize
96KB

Download
memory/1312-8-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/1312-9-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/1312-10-0x00000000067A0000-0x0000000006854000-memory.dmp

Filesize
720KB

Download
memory/1312-11-0x0000000008D40000-0x0000000008D84000-memory.dmp

Filesize
272KB

Download
memory/1312-2-0x0000000005D90000-0x0000000006334000-memory.dmp

Filesize
5.6MB

Download
memory/1312-14-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/1312-1-0x0000000000CA0000-0x0000000000D86000-memory.dmp

Filesize
920KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads