formbook | fcf79460d76c4fb62b3176e31e80f5a2d308571a44b2febf4732753952437361

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
Size

736KB
MD5

682a308af795b0542426eb8519f3ea1f
SHA1

e91183813806c5a641824f717963c40b2df9b80c
SHA256

fcf79460d76c4fb62b3176e31e80f5a2d308571a44b2febf4732753952437361
SHA512

5471dad3c8b5daafd2e16b778c2b54104ad6c8a0c59ba3a77e0dfd9e37c9cf3a72cf7da54cc63904385793f74237101acad96ab3905243539bee96e8ce1f0220
SSDEEP

6144:zTOud2PugbKPEP0B+c0LvVpOT1mTqpFpUYrER0u+GIIIIIIIhIIIIIIIIIIIIII3:zTOMgboLw9TTmpsm5

Score

10^/10

formbook js rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

Decoy

bensenmaoyi.com

baogold.com

ornellamultimedia.com

0-lqn5-x50-90bl4.com

nearmedesign.services

xuansenmuyi.com

tuktukdude.com

hedgepayday.com

0p0tenkey.men

tashanetea.com

candacehkang.com

benhvienphusansaigon.com

victoriasweitzer.com

lowellcremation.com

naturesgives.com

noengordar.com

mypictureparadise.com

upad.ltd

trailrack.com

stariptvitalia.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4856-3-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4924	4856	WerFault.exe	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
1616	4856	WerFault.exe	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

pid process

4856 682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
4856 682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

pid process

4856 682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
4856 682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

pid process

4856 682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
4856 682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

pid process

4856 682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

pid	process
4856	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
4856	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

pid	process
4856	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
4856	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

pid	process
4856	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
4856	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

pid	process
4856	682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\682a308af795b0542426eb8519f3ea1f_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 472
2⤵
- Program crash
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 680
2⤵
- Program crash
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4856 -ip 4856
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4856 -ip 4856
1⤵
PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4856-3-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4856-4-0x00000000778B1000-0x00000000779D1000-memory.dmp

Filesize
1.1MB

Download
memory/4856-5-0x000000000B1F0000-0x000000000B53A000-memory.dmp

Filesize
3.3MB

Download