formbook | 3400e42731d3737a64af32e4ce085979807a70aaa7e7a9137de73f2b738daa1c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
Size

396KB
MD5

6718b469b6916b6d72a29ed23e6eda52
SHA1

ff778f57acdaa1ec9e467e562028e84d66e4fa3f
SHA256

3400e42731d3737a64af32e4ce085979807a70aaa7e7a9137de73f2b738daa1c
SHA512

66d8a389becf11c7cf76757b9fc0b11b44a9922eb2947997e5ec7935fd57f83032311c8a831f471f497aa70c616a24a1a8fcc2a7497adcfc7c075a48c5e73189
SSDEEP

6144:4VL0nt7DmqFVXJ/sRw5bdKeHrlfxvpszSbSRKDA2bPhleIq:OuxXJ/sRw5dKeLfCzSBThle

Score

10^/10

formbook h362 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

h362

Decoy

optimisticit.com

vuoto-visual.com

therealestatecenter.info

buckluvinpearlgirl2018.com

thecutfactoryso.com

healthyminde.com

remitandswitch.com

oregonawaits.info

sidesteem.com

dopper2018.net

villacoquito.com

theartofrecieving.com

fake-kevin-domain-fake123.com

adlibexeclodge.com

web-chops.com

darkflamearchives.com

mobileappsdirectnow.com

krismartinpr.com

visorsports.com

gisaeng.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2112-8-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

description	pid	process	target process
PID 2068 set thread context of 2112	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

pid process

2112 6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2068 6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

pid	process
2112	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

description	pid	process	target process
PID 2068 wrote to memory of 2112	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
PID 2068 wrote to memory of 2112	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
PID 2068 wrote to memory of 2112	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
PID 2068 wrote to memory of 2112	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
PID 2068 wrote to memory of 2112	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
PID 2068 wrote to memory of 2112	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
PID 2068 wrote to memory of 2112	2068	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe	6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068

C:\Users\Admin\AppData\Local\Temp\6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6718b469b6916b6d72a29ed23e6eda52_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x00000000742AE000-0x00000000742AF000-memory.dmp

Filesize
4KB

Download
memory/2068-1-0x0000000001000000-0x000000000106A000-memory.dmp

Filesize
424KB

Download
memory/2068-2-0x0000000000570000-0x0000000000588000-memory.dmp

Filesize
96KB

Download
memory/2068-3-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/2068-4-0x00000000742AE000-0x00000000742AF000-memory.dmp

Filesize
4KB

Download
memory/2068-5-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/2068-6-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/2068-7-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/2068-10-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/2068-9-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2112-11-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads