formbook | a4271f90dd2b97e70d59e02ccd1f2337446e0fea5beb5a40daa79553c6fb53d0

General

Target

fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
Size

965KB
MD5

fd18568bf53506ddceacfeee0210e8c8
SHA1

433fd427aec8735453907988c31f63831c1c487d
SHA256

a4271f90dd2b97e70d59e02ccd1f2337446e0fea5beb5a40daa79553c6fb53d0
SHA512

268b588b8c0b435f548b26d8019fdd5f2a184c67b9ad4578bc95937f52f50d210407c17a8d928b2a8a662cf06482caeef5e4c8e31d129a082fd5b5eba83efe61
SSDEEP

12288:nuDc9F3nC0Py3gAhSEJbjJEK9guo0lMS5WqlH3vqlIvDV9oAggPKSA/pYkT5d:2gJKlHmIvzmSWZT5

Score

10^/10

formbook kkt rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kkt

Decoy

inspirafutebol.com

customgiftshouston.com

mycreativelending.com

psplaystore.com

newlivingsolutionshop.com

dechefamsterdam.com

servicingl0ans.com

atsdholdings.com

manifestarz.com

sequenceanalytica.com

gethealthcaresmart.com

theartofsurprises.com

pirateequitypatrick.com

alliance-ce.com

wingrushusa.com

funtimespheres.com

solevux.com

antimasathya.com

profitexcavator.com

lankeboxshop.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2672-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

description	pid	process	target process
PID 1196 set thread context of 2672	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exefd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

pid	process
1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
2672	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1196 fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

description	pid	process	target process
PID 1196 wrote to memory of 2560	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2560	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2560	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2560	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2672	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2672	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2672	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2672	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2672	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2672	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
PID 1196 wrote to memory of 2672	1196	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe	fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196

C:\Users\Admin\AppData\Local\Temp\fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe"
2⤵
PID:2560

C:\Users\Admin\AppData\Local\Temp\fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd18568bf53506ddceacfeee0210e8c8_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2672

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-6-0x0000000005840000-0x00000000058E4000-memory.dmp

Filesize
656KB

Download
memory/1196-0-0x0000000000E60000-0x0000000000F56000-memory.dmp

Filesize
984KB

Download
memory/1196-2-0x0000000004F20000-0x0000000004F60000-memory.dmp

Filesize
256KB

Download
memory/1196-3-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download
memory/1196-4-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1196-5-0x0000000004F20000-0x0000000004F60000-memory.dmp

Filesize
256KB

Download
memory/1196-1-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1196-7-0x00000000009E0000-0x0000000000A14000-memory.dmp

Filesize
208KB

Download
memory/1196-13-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2672-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2672-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2672-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-14-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads