formbook | 5c08d875ce6e830acd443b62b7db10aac4d335afcee20423a703ea0c15b36368

Analysis

max time kernel
136s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe
Size

715KB
MD5

4a88ef067c92ec50842f31d0cd49ceee
SHA1

fca2bb6c3785c7d786a5c13d05043ce004a9b618
SHA256

5c08d875ce6e830acd443b62b7db10aac4d335afcee20423a703ea0c15b36368
SHA512

25b17a4f0b1bd202cd53f8f98ec4f96cb477386abe1f84081f1a98c0a0d3f97101a0907c7f276e0894a1b0c5b5a3877b362d89f82a48930dbbdf8a21a088a988
SSDEEP

12288:Q2m9mygck7g4++RWR7imOxL80hHtlY6k3B0G/DV7HU+javpV2g:/2TgBtmRfOV3Htm6k3mGhHU+jaxA

Score

10^/10

formbook d003 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

d003

Decoy

grupojcs.com

sdiezk.com

crazycravecosmetics.com

addison.site

gaziantepcicekal.com

globetrotterscourier.online

ppluav69.com

desanitarium.com

jiuxutang.net

rennaidangpu.com

wkc365.com

meanfarmer.net

yeosuchonnom.com

9876n.com

aesthetics-academy.com

chaoyumoju.com

tuscoordenadas.com

diveregalos.com

bombougeral.info

roxfranzhoerspringstzer.win

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3708-2-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe

description	pid	process	target process
PID 2732 set thread context of 3708	2732	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe

pid	process
2732	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe
2732	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe
3708	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe
3708	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe

pid process

2732 4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe

description	pid	process	target process
PID 2732 wrote to memory of 3708	2732	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe
PID 2732 wrote to memory of 3708	2732	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe
PID 2732 wrote to memory of 3708	2732	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe	4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a88ef067c92ec50842f31d0cd49ceee_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2732-1-0x00000000022C0000-0x00000000022D3000-memory.dmp

Filesize
76KB

Download
memory/2732-3-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/2732-4-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/3708-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3708-5-0x0000000000430000-0x00000000004F9000-memory.dmp

Filesize
804KB

Download