formbook | a1eaf372496b5a54a67e772fe031414ce104886fddd2f775123759c2bcb3819c

Analysis

max time kernel
135s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
Size

316KB
MD5

5d5297752ebeacf205e85da6abee7b51
SHA1

effbac213eaf8215922eebeeb9af3c0c0ff4db72
SHA256

a1eaf372496b5a54a67e772fe031414ce104886fddd2f775123759c2bcb3819c
SHA512

5a2d105c33673ec3aa8bcf7f2e6de3c825a3e45ba57b209b5c94cf9011a481790ff7f9b9c9331339ad6766500c9f64b87d38ef0191943302403bab77d804c214
SSDEEP

6144:AX2rqWgiLCLD8G/5qrXiSia2KxgwtCZQ:AmrnLCLDSrXwa2KHtcQ

Score

10^/10

formbook ch77 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

ch77

Decoy

mkgroupjo.com

5542sss.com

flightmeadery.com

xn--rss22ky99a.com

huangdigan.net

homefinanceoption.com

xn--yh4bv0fa.com

233bu.com

malcolminternational.info

intercalperu.com

myfreestyleonline.com

vandaliapress.com

hubeijundu.com

uql22ze.com

online-biz-internet-orlando.com

13390181555.com

makadibay.online

rente-bike.com

xn--io3aw0du0f.com

akchurch.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/880-4-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

description	pid	process	target process
PID 1912 set thread context of 880	1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid process

880 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
880 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid process

1912 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
1912 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid process

1912 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
1912 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid process

1912 5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid	process
880	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
880	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid	process
1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid	process
1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

pid	process
1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

description	pid	process	target process
PID 1912 wrote to memory of 880	1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 1912 wrote to memory of 880	1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 1912 wrote to memory of 880	1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 1912 wrote to memory of 880	1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 1912 wrote to memory of 880	1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 1912 wrote to memory of 880	1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
PID 1912 wrote to memory of 880	1912	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe	5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912

C:\Users\Admin\AppData\Local\Temp\5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d5297752ebeacf205e85da6abee7b51_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/880-8-0x0000000000A80000-0x0000000000DCA000-memory.dmp

Filesize
3.3MB

Download
memory/1912-3-0x0000000003B00000-0x0000000003B10000-memory.dmp

Filesize
64KB

Download
memory/1912-2-0x0000000003B00000-0x0000000003B10000-memory.dmp

Filesize
64KB

Download
memory/1912-5-0x0000000076F31000-0x0000000077051000-memory.dmp

Filesize
1.1MB

Download