Analysis
- max time kernel
55s - max time network
50s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
27/04/2024, 23:09
General
- Target 03d6a18a555baf86856a5a175f9c5fd1_JaffaCakes118.exe
- Size 322KB
- Sample240427-25bkdaaf55
- SHA256 8abcc938aa54e577deda50c0e49029a71d4acff145457b957dcb2620dbf8845c
Malware Config
Extracted
-
formbook
-
3.9
-
rl
-
seguin-aurillac.com
-
108manbetx.com
-
abbeysbeat.com
-
olerne.com
-
hotelresortsupplier.com
-
tile-machines.com
-
o2tourist.com
-
ruidadp.com
-
hempfour.life
-
cdnhf.com
-
vivacleaningservices.com
-
mountaintravelagency.com
-
bohniverse-ladungssicherung.com
-
cfuzvs.info
-
musiclave.com
-
jiexingxidi.com
-
tonaro.net
-
gulfvatsolution.info
-
tissotcapital.com
-
expertcatcare.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03d6a18a555baf86856a5a175f9c5fd1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03d6a18a555baf86856a5a175f9c5fd1_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\03d6a18a555baf86856a5a175f9c5fd1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03d6a18a555baf86856a5a175f9c5fd1_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/660-0-0x00000000749F0000-0x0000000074FA1000-memory.dmp
memory/660-1-0x00000000011E0000-0x00000000011F0000-memory.dmp
memory/660-2-0x00000000749F0000-0x0000000074FA1000-memory.dmp
memory/660-3-0x00000000749F0000-0x0000000074FA1000-memory.dmp
memory/660-4-0x00000000011E0000-0x00000000011F0000-memory.dmp
memory/660-7-0x00000000749F0000-0x0000000074FA1000-memory.dmp
memory/804-5-0x0000000000400000-0x000000000042A000-memory.dmp
memory/804-8-0x00000000019F0000-0x0000000001D3A000-memory.dmp