formbook | 21da3823ffb535bf77b19ce43b741011f3783180ab5d74e2aab69ce311ed86fb

General

Target

f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe
Size

364KB
MD5

f8e122f72847d6c6133b410dd9d06a8f
SHA1

1cf6f55e113da6d0d73437575765636be7e94416
SHA256

21da3823ffb535bf77b19ce43b741011f3783180ab5d74e2aab69ce311ed86fb
SHA512

d64a811adead1bbb7f1a2b3a2d55d1089578292557274b2878b2d5f6453a9a180d244440b94acc62be60d642075c9e743d220805e94e655effc08089c2bf5835
SSDEEP

6144:FVyyLh9/9hNNBldy0dgpffM8SVvc+j/rz6ceAbzF62/nMeWXQN:7tb/HHBHnd4fffkco2ZAf7WX2

Score

10^/10

formbook dd2v rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dd2v

Decoy

jkrqzmeyd.icu

cbluedottvwdshop.com

yhchen.space

premierhealthnwellness.com

szkuyaju.com

harvestmoonloans.net

dadematerial.com

mariaclarahairstudio.com

hwunvy.online

puloutjbmere.com

kossu1989.com

dubbedos.com

ncylis.com

hybrid-sol.com

travelature.com

gracefulcounts.com

66secretgarden.com

eslonyourcell.com

wisersponsorship.com

sepn3.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2200-2-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/2200-6-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/2200-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1300-17-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook
behavioral1/memory/1300-25-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

Processes:

f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exesvchost.exesystray.exe

description	pid	process	target process
PID 1340 set thread context of 2200	1340	f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe	svchost.exe
PID 2200 set thread context of 1204	2200	svchost.exe	Explorer.EXE
PID 2200 set thread context of 1204	2200	svchost.exe	Explorer.EXE
PID 1300 set thread context of 1204	1300	systray.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

svchost.exesystray.exe

pid	process
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe
1300	systray.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exesvchost.exesystray.exe

pid	process
1340	f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
1300	systray.exe
1300	systray.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exesystray.exe

description pid process

Token: SeDebugPrivilege 2200 svchost.exe
Token: SeDebugPrivilege 1300 systray.exe

description	pid	process
Token: SeDebugPrivilege	2200	svchost.exe
Token: SeDebugPrivilege	1300	systray.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exeExplorer.EXEsystray.exe

description	pid	process	target process
PID 1340 wrote to memory of 2200	1340	f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 2200	1340	f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 2200	1340	f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 2200	1340	f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 2200	1340	f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe	svchost.exe
PID 1204 wrote to memory of 1300	1204	Explorer.EXE	systray.exe
PID 1204 wrote to memory of 1300	1204	Explorer.EXE	systray.exe
PID 1204 wrote to memory of 1300	1204	Explorer.EXE	systray.exe
PID 1204 wrote to memory of 1300	1204	Explorer.EXE	systray.exe
PID 1300 wrote to memory of 2556	1300	systray.exe	cmd.exe
PID 1300 wrote to memory of 2556	1300	systray.exe	cmd.exe
PID 1300 wrote to memory of 2556	1300	systray.exe	cmd.exe
PID 1300 wrote to memory of 2556	1300	systray.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\f8e122f72847d6c6133b410dd9d06a8f_JaffaCakes118.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1868

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\svchost.exe"
3⤵
PID:2556

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-20-0x0000000006120000-0x000000000621C000-memory.dmp

Filesize
1008KB

Download
memory/1204-8-0x00000000000B0000-0x00000000001B0000-memory.dmp

Filesize
1024KB

Download
memory/1204-14-0x0000000006750000-0x000000000686E000-memory.dmp

Filesize
1.1MB

Download
memory/1204-9-0x0000000006120000-0x000000000621C000-memory.dmp

Filesize
1008KB

Download
memory/1204-23-0x0000000006750000-0x000000000686E000-memory.dmp

Filesize
1.1MB

Download
memory/1300-21-0x0000000000410000-0x00000000004A3000-memory.dmp

Filesize
588KB

Download
memory/1300-18-0x00000000021A0000-0x00000000024A3000-memory.dmp

Filesize
3.0MB

Download
memory/1300-17-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/1300-25-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/1300-15-0x0000000000D90000-0x0000000000D95000-memory.dmp

Filesize
20KB

Download
memory/1300-16-0x0000000000D90000-0x0000000000D95000-memory.dmp

Filesize
20KB

Download
memory/1340-1-0x00000000000D0000-0x00000000000D2000-memory.dmp

Filesize
8KB

Download
memory/1340-0-0x0000000000120000-0x0000000000149000-memory.dmp

Filesize
164KB

Download
memory/1340-3-0x0000000000120000-0x0000000000149000-memory.dmp

Filesize
164KB

Download
memory/2200-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2200-12-0x0000000000320000-0x0000000000334000-memory.dmp

Filesize
80KB

Download
memory/2200-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2200-7-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download
memory/2200-4-0x00000000009C0000-0x0000000000CC3000-memory.dmp

Filesize
3.0MB

Download
memory/2200-2-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads