formbook | 6fd8fde47bfdecf4c5fa63b708ef5f28ba0b9417eab79ac395cd6bf068eedcc7

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe
Size

837KB
MD5

772818fce7b10874f4966be5a8cd7c27
SHA1

a60926d4ee84fe6da426a6165ca6f02ef6e1fbbf
SHA256

6fd8fde47bfdecf4c5fa63b708ef5f28ba0b9417eab79ac395cd6bf068eedcc7
SHA512

bf76e0c30b5ab8e77c281482cf78724174057370bc05911f6f574c62b8d3904be4822a9e54287eda813a84a0038dbb038f356ea9696dd931b260b1937509bd06
SSDEEP

24576:81KWCAI+LdOTOi8r+/ZS5TPhPJfQV9wMok:kbIsOTOiBZSpPhG9wMT

Score

10^/10

formbook dg1 agilenet rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

dg1

Decoy

pilatesmania.life

5bcoin.com

ammowillcall.com

quickwinz.market

terigele.com

sohotoken.com

tielingwww.site

lz2b3.info

norisc.com

digitalkonsultan.com

925manbetx.com

laricipark.com

quantum7nutrition.com

xceedcg.com

hanagel.com

cane91.download

iotadocker.com

brackenupholstery.com

erfolg-sichern.online

bihuorg.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4996-8-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/5036-4-0x00000000051B0000-0x00000000051E0000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 4996	5036	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4996	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe
4996	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4996	5036	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe	96
PID 5036 wrote to memory of 4996	5036	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe	96
PID 5036 wrote to memory of 4996	5036	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe	96
PID 5036 wrote to memory of 4996	5036	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe	96
PID 5036 wrote to memory of 4996	5036	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe	96
PID 5036 wrote to memory of 4996	5036	772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\772818fce7b10874f4966be5a8cd7c27_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4996-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4996-11-0x00000000014A0000-0x00000000017EA000-memory.dmp

Filesize
3.3MB

Download
memory/5036-0-0x000000007467E000-0x000000007467F000-memory.dmp

Filesize
4KB

Download
memory/5036-1-0x0000000000740000-0x0000000000818000-memory.dmp

Filesize
864KB

Download
memory/5036-2-0x00000000056F0000-0x0000000005C94000-memory.dmp

Filesize
5.6MB

Download
memory/5036-3-0x00000000051E0000-0x0000000005272000-memory.dmp

Filesize
584KB

Download
memory/5036-4-0x00000000051B0000-0x00000000051E0000-memory.dmp

Filesize
192KB

Download
memory/5036-5-0x00000000053C0000-0x00000000053C6000-memory.dmp

Filesize
24KB

Download
memory/5036-6-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/5036-7-0x0000000008410000-0x00000000084AC000-memory.dmp

Filesize
624KB

Download
memory/5036-10-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download