formbook | a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe
Size 395KB
Sample240531-hhlbhsbb66
SHA256 a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b
MD5 863bf0dfa1169706f566c070a1e11256
SHA1 77175726680e40eeefdad0578a1d3377486d9fff
SHA512 21aef52bb4b5ed66c632c0ca55e156b95dd5bf2715599880fb0b5ffea523fca0b82739cf2617095336c332664ab8dcdd64fa910d3bae64c9f384767709720ada
SSDEEP 12288:nanOzOlC9Am80quPgdBHh/FOPfe+VYRVORkG:lqltm80qigrHxFGVYbi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook c232 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

c232

Decoy

tangdourenfz.com
helpforkids.today
bioethanol-us.com
0351zc.com
3rdimultimedia.com
thecannibisconnection.net
mktoob.net
orchidinvestmentlimited.com
moccustoms.com
shopendora.com
rosariosandino.com
bien-vivre-tunisie.com
godofgreens.com
nhathuocphuongle.com
thefastsource.com
viagra2tadalafil.com
abarroteslacanasta.com
versabiosciences.com
nergiztarimhayvancilik.com
airpodsbayi.com
fitnessdan.com
passionunipessoal.com
spl.energy
review-id9326.com
studystudy.xyz
syringacio.com
beensentoe.com
pasforon.com
omegagyn.com
yourmassagewellness.com
develop-er.com
biosqualene.com
smartlocalizer.com
impotsgovparticulier.digital
primponabarbie.world
energy-x.site
tatlerstyle.com
shucaiw.pro
kita-minimum.com
nirvanatopshelf.com
thefrontrangedeals.com
cbaenterpriseaccount.com
antalyadissagligi.com
drivewalkbike.com
learn2pop.com
suzhoukelida.com
alloutthere.com
cle-ar.com
ditaaulia.online
solarpowermate.com
amazon-account-service-webs.com
7jonquilcourt.com
beautyart-marrakech.com
asaany.com
barinetportal.com
benbernardfilms.com
mousepays.com
insidethelooppodcast.com
seatedworkouts.com
ketch-mania.com
qingfuhall.com
euphoricempress.com
veomtreadmillexpert.com
bigboltbooks.com
dokap.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/2712-27-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/2712-30-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

pid	Process
2620	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2712	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2620	rundll32.exe
2712	cmd.exe
2712	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2620	rundll32.exe
2712	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	cmd.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2620	1732	863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe	28
PID 1732 wrote to memory of 2620	1732	863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe	28
PID 1732 wrote to memory of 2620	1732	863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe	28
PID 1732 wrote to memory of 2620	1732	863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe	28
PID 1732 wrote to memory of 2620	1732	863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe	28
PID 1732 wrote to memory of 2620	1732	863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe	28
PID 1732 wrote to memory of 2620	1732	863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe	28
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2620 wrote to memory of 2712	2620	rundll32.exe	29
PID 2712 wrote to memory of 2660	2712	cmd.exe	30
PID 2712 wrote to memory of 2660	2712	cmd.exe	30
PID 2712 wrote to memory of 2660	2712	cmd.exe	30
PID 2712 wrote to memory of 2660	2712	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe SitulaCystocele,Hurley
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 208
      4⤵
      Program crash
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Prosody

Path C:\Users\Admin\AppData\Local\Temp\Prosody
Size 231KB
SHA256 27c010483a5665042dd6c20c69f9fdc4bbe9f7bf7fcc516f51cc8318a8c3b844
MD5 6847287ec5adf184583fac09b774e5dd
SHA1 52183c47dd439a5695eee05e2f22608e32179427
SHA512 1e7dbf36ac5949e120f804ebd986882e7d66ce1dc3bd8d0888073ea2f3f07fc13d8d11669372822d3630caf299a1675fd9cf62891203d67b8685520ff3d2775d
SSDEEP 3072:qUHfey9EV+nU39H7PbC2Rj7vsWPXPAEBnRh+cKKAZlVzY11BtYQuPf8h8d16D6RW:flEcyR7iEBRheltYPPOPf++bKiYR2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

SitulaCystocele.DLL

Path C:\Users\Admin\AppData\Local\Temp\SitulaCystocele.DLL
Size 50KB
SHA256 18e86106e60613594527c85fe6c97287fc8c3715181a62cb2b4d2258c210b6c8
MD5 de3f3ceccff80b3b0cc7e8cc58357b70
SHA1 701387d5e62903e114f4bdf59cd4f89cc6b2ad4e
SHA512 ad16ea6af2200f7f8a8c0fd0cc1fe5c935942a8789ce057818499b1a51865bb4a0b39a4091f84a2652d2c6ea7569e3829dd5b3043b2d44083a597f3954c2c6db
SSDEEP 1536:5EOuTAjdpOExDJANAB/qepudoVoD3Qu3IEN:5yA/DJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2620-21-0x0000000000180000-0x0000000000182000-memory.dmp

Download

memory/2620-22-0x0000000074C90000-0x0000000074CE8000-memory.dmp

Download

memory/2620-23-0x0000000076510000-0x0000000076545000-memory.dmp

Download

memory/2620-25-0x0000000074C90000-0x0000000074CE8000-memory.dmp

Download

memory/2712-24-0x0000000000090000-0x0000000000096000-memory.dmp

Download

memory/2712-27-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2712-28-0x0000000002210000-0x0000000002513000-memory.dmp

Download

memory/2712-30-0x0000000000400000-0x000000000042E000-memory.dmp

Download