formbook | 8aafecddd3b462d27c24000757496edb5c6bce1e6abff9157d5360457b0805d7

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe
Size

873KB
MD5

79f04bd1fc5f9757f7979bb8cbefdd5e
SHA1

e34056989f520736af44df68d869b71a4d4d695f
SHA256

8aafecddd3b462d27c24000757496edb5c6bce1e6abff9157d5360457b0805d7
SHA512

40836cc07e0ea529e31c2b9e36c639d486aee5ec2c0fbcffdd7e006aa0f345eb96930833113e371719d6d5dac4c36a4ee60c62fdd776b2201fea3abff21671d2
SSDEEP

12288:UDb7BqrErn/mxx7E6vMJaxKwWoFJm6y2o/Yc4/P2x1AFZpqzN7FCIZZBzFs8dDkP:UFBrny7d7eqq2Z32AqhJz68dw

Score

10^/10

formbook tln rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

tln

Decoy

themayoparty.com

theselfloveknowing.com

fresnospeechpathologist.com

logopedieameliekerenae.com

creditcommoncents.com

saliwasims.com

steelmannews.com

pdsxinfuding.com

cashflowtoday.net

daddaenterprises.com

kjvrvg.com

onthejoblanguages.com

montieri.net

implusefit.com

proseo.digital

handymanwashingtondc.com

michahahn.com

tesla-vtc.com

andreasott.online

kalinsack.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4904-4-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe

description	pid	process	target process
PID 4472 set thread context of 4904	4472	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe

pid	process
4472	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe
4472	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe
4904	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe
4904	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe

pid process

4472 79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe

description	pid	process	target process
PID 4472 wrote to memory of 4904	4472	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe
PID 4472 wrote to memory of 4904	4472	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe
PID 4472 wrote to memory of 4904	4472	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe	79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4472

C:\Users\Admin\AppData\Local\Temp\79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4472-0-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/4472-2-0x00000000023D0000-0x00000000023E0000-memory.dmp

Filesize
64KB

Download
memory/4472-1-0x00000000023D0000-0x00000000023E0000-memory.dmp

Filesize
64KB

Download
memory/4472-3-0x0000000003F70000-0x0000000003F71000-memory.dmp

Filesize
4KB

Download
memory/4472-5-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4904-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download