Analysis
- max time kernel
142s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
07/05/2024, 02:00
General
- Target 1f112904748a1369e6fe50dee8b00756_JaffaCakes118.exe
- Size 595KB
- Sample240507-cffelagd57
- SHA256 d5c67af1346fed0b4ef7106cdca4ed27c8a574bd0b4e01258d56eec76a8e2968
Malware Config
Extracted
-
formbook
-
3.8
-
yo
-
creditformula.net
-
marketingwo.com
-
xn--w9q221mxha.com
-
mandanudes.com
-
dignity.exchange
-
outdooreveryday.com
-
legalandmedicaltranslations.com
-
grassrootsheals.com
-
voranado.com
-
thedayofficial.com
-
xn--6cs32cp56d.com
-
paketwisata.info
-
2b.church
-
konzerthausmuc.com
-
analytics-scanner.com
-
bodyperceptiontreatment.com
-
katyastan.com
-
ldede.win
-
eqy7g0.win
-
ewyurija.win
Signatures
- Detect ZGRat V1 1 IoCs
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- ZGRat
ZGRat is remote access trojan written in C#.
- Formbook payload 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f112904748a1369e6fe50dee8b00756_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f112904748a1369e6fe50dee8b00756_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1f112904748a1369e6fe50dee8b00756_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f112904748a1369e6fe50dee8b00756_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3412-9-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3412-12-0x00000000017B0000-0x0000000001AFA000-memory.dmp
memory/4128-0-0x000000007538E000-0x000000007538F000-memory.dmp
memory/4128-1-0x0000000000870000-0x000000000090C000-memory.dmp
memory/4128-2-0x0000000007700000-0x0000000007728000-memory.dmp
memory/4128-3-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/4128-4-0x0000000007EA0000-0x0000000008444000-memory.dmp
memory/4128-5-0x0000000007840000-0x00000000078D2000-memory.dmp
memory/4128-6-0x000000007538E000-0x000000007538F000-memory.dmp
memory/4128-7-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/4128-8-0x0000000005260000-0x00000000052FC000-memory.dmp
memory/4128-11-0x0000000075380000-0x0000000075B30000-memory.dmp