formbook | dad11fdf5a3a11a994aef087a1ef80ca70e951a986ae89839d51c28678add492

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe
Size 627KB
Sample240625-wh2kdstgre
SHA256 dad11fdf5a3a11a994aef087a1ef80ca70e951a986ae89839d51c28678add492
MD5 0f00d594ae90f555e1f54e4dc3b22c8c
SHA1 ff6849f00b71fa53daff0301c924da576168d30e
SHA512 011a71c37ba2eeeca4e6dde640a95f3875d82f4bac9baad13f76770fa1693f68c42710aa2c37c5036d319d112eb143098e8f5c7a5dbb8576a1c6410868fb2f22
SSDEEP 12288:0J2hwy8lB6yr2804FNz1F1gjHxFonkDvr2CdKZ8rjFYeM:A2hW6yPt1PgjPonkDvr2zZ8rjE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook whn rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

Decoy

braidwooduk.com
dryneedlingmia.com
sacburgermonth.com
jacekkurek.com
satovic-medical-labo.com
fessuseqaredsee.com
lnxjy.com
virtualstudiosapp.com
thepreparatoryphysio.com
maxidef.com
hdlivesonlinetv24.com
caringedgedhr.net
battlepaches.com
incredihouses.com
breadslicerblade.com
earthscience.club
soar.supply
alogralpca.info
pagucchan.info
digitacard.com
xn--9t4b11d99a4r.com
sublimebeautypalace.com
jadeetching.com
kurokawa-bebida.com
nancet.com
mandevilleconsultant.online
niaford.com
design8beyond.com
mithrasaree.com
queenzjewelz.com
entrepreneurshipmindset.com
santalbysercio.com
patxipiruli.com
golden-harmony.com
gideonbleak.com
ntytqx.com
happyspaceproperties.com
eewin-vip.com
frontpagearticles.com
fine1002.academy
derechoconsumidores.com
shopdollyparton.com
275215.com
leiyinkl.com
yeasuc.com
historydaze.com
opennetwifi.online
alakhbaralalamianews.com
nqh1.com
xrpripple.fund
securehuntington.info
thetoolbx.com
sparklfencing.com
soberrhode.net
slingshotfun.com
staceybartels.com
glencoreinternal.net
pdfshelf.club
rsdpinfotech.com
acehsports.com
brakemans.repair
walkingartbyduane.com
orsayfootball.com
qqcaotv.com
surdicbeard.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2988-5-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3660 set thread context of 2988	3660	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2988	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe
2988	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2988	3660	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe	90
PID 3660 wrote to memory of 2988	3660	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe	90
PID 3660 wrote to memory of 2988	3660	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe	90
PID 3660 wrote to memory of 2988	3660	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe	90
PID 3660 wrote to memory of 2988	3660	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe	90
PID 3660 wrote to memory of 2988	3660	0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Users\Admin\AppData\Local\Temp\0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0f00d594ae90f555e1f54e4dc3b22c8c_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-5-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2988-8-0x00000000019E0000-0x0000000001D2A000-memory.dmp

Download

memory/2988-9-0x00000000019E0000-0x0000000001D2A000-memory.dmp

Download

memory/3660-0-0x0000000074892000-0x0000000074893000-memory.dmp

Download

memory/3660-1-0x0000000074890000-0x0000000074E41000-memory.dmp

Download

memory/3660-2-0x0000000074890000-0x0000000074E41000-memory.dmp

Download

memory/3660-3-0x0000000074892000-0x0000000074893000-memory.dmp

Download

memory/3660-4-0x0000000074890000-0x0000000074E41000-memory.dmp

Download

memory/3660-7-0x0000000074890000-0x0000000074E41000-memory.dmp

Download