formbook | 67f8ad3999ae43679f67d54be1fd73f0a009b0509f7284ad0ad726615e83e139

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
Size

428KB
MD5

640a5a69bb8bad401d53decd4cc8ca20
SHA1

01fa7024fd76ca92eccc565e2c393048b3f11c51
SHA256

67f8ad3999ae43679f67d54be1fd73f0a009b0509f7284ad0ad726615e83e139
SHA512

32b59acacd1ada2c488a91130e28196556687e4b5fb41b46b959ff25ef7cb2ad6e2f77d37a53eadb0b9823bb084547bff841e3d4e47b56491e5fd26ac2cc66f3
SSDEEP

6144:EwuOFkQsk7HjHaPnjsxnxoZunk+dbRyPEIBSSh4a5yZQlgy85iA2p07ybCx7XtnC:MQsk7+LI5RCzjTSybyXZ

Score

10^/10

formbook h313 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

h313

Decoy

kudaspb.info

riven.market

strictlyafricanjapan.win

moresisebank.com

lugg14141.com

musictravelbar.com

snip-store.net

mnum2.com

inevitably.ltd

topskin-care.live

chinasmokingglass.com

milkmuuske.com

gadology.com

lntoken.com

wxtusugangguan.com

freetraffic2upgradeall.review

myhumblenode.com

otodo.site

ryden-mckenna-ltd.com

diminishedunison.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1936-4-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

description	pid	process	target process
PID 1928 set thread context of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

pid process

1936 640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

pid process

1928 640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
1928 640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

pid process

1928 640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
1928 640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

pid process

1928 640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

pid	process
1936	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

pid	process
1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

pid	process
1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

pid	process
1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

description	pid	process	target process
PID 1928 wrote to memory of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
PID 1928 wrote to memory of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
PID 1928 wrote to memory of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
PID 1928 wrote to memory of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
PID 1928 wrote to memory of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
PID 1928 wrote to memory of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
PID 1928 wrote to memory of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
PID 1928 wrote to memory of 1936	1928	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe	640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\640a5a69bb8bad401d53decd4cc8ca20_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-2-0x00000000775A1000-0x00000000776A2000-memory.dmp

Filesize
1.0MB

Download
memory/1928-3-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download
memory/1936-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1936-5-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download