formbook | a1eaf372496b5a54a67e772fe031414ce104886fddd2f775123759c2bcb3819c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
Size

316KB
MD5

5d5297752ebeacf205e85da6abee7b51
SHA1

effbac213eaf8215922eebeeb9af3c0c0ff4db72
SHA256

a1eaf372496b5a54a67e772fe031414ce104886fddd2f775123759c2bcb3819c
SHA512

5a2d105c33673ec3aa8bcf7f2e6de3c825a3e45ba57b209b5c94cf9011a481790ff7f9b9c9331339ad6766500c9f64b87d38ef0191943302403bab77d804c214
SSDEEP

6144:AX2rqWgiLCLD8G/5qrXiSia2KxgwtCZQ:AmrnLCLDSrXwa2KHtcQ

Score

10^/10

formbook ch77 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

ch77

Decoy

mkgroupjo.com

5542sss.com

flightmeadery.com

xn--rss22ky99a.com

huangdigan.net

homefinanceoption.com

xn--yh4bv0fa.com

233bu.com

malcolminternational.info

intercalperu.com

myfreestyleonline.com

vandaliapress.com

hubeijundu.com

uql22ze.com

online-biz-internet-orlando.com

13390181555.com

makadibay.online

rente-bike.com

xn--io3aw0du0f.com

akchurch.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2400-4-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

description	pid	process	target process
PID 2116 set thread context of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid process

2400 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid process

2116 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
2116 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid process

2116 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
2116 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid process

2116 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid	process
2400	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid	process
2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid	process
2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid	process
2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

description	pid	process	target process
PID 2116 wrote to memory of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 2116 wrote to memory of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 2116 wrote to memory of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 2116 wrote to memory of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 2116 wrote to memory of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 2116 wrote to memory of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 2116 wrote to memory of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 2116 wrote to memory of 2400	2116	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Local\Temp\5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2400

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-2-0x0000000003B60000-0x0000000003BA0000-memory.dmp

Filesize
256KB

Download
memory/2116-3-0x0000000003B60000-0x0000000003BA0000-memory.dmp

Filesize
256KB

Download
memory/2116-5-0x0000000077AD0000-0x0000000077BA6000-memory.dmp

Filesize
856KB

Download
memory/2400-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2400-8-0x00000000006E0000-0x00000000009E3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads