formbook | 17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
Size

744KB
MD5

185ee8d153bc97bd21cf3baef478dec0
SHA1

82d941989e8feba6a6c25b8e6812b8e22be51fd3
SHA256

17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c
SHA512

38de1cff02350f6ac7acc0a3fadb0029c33368465af9b75806fe2627eb12eafbb1fdceea749f37af70263fac04a1ceefc902344eb5b8338eb3f171f6f01d3c41
SSDEEP

12288:TQirjDMcnoE0LtEx6UxNqj+stiD5mKsmlNy53tlRRm/YNUzn:TQuD1t0LtExjqj+wwctmS3t8QN

Score

10^/10

formbook grv rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

grv

Decoy

morganofatlanta.com

vz473.com

hengetelt.com

bailcally.com

virtuosoonline.com

tenthousandli.com

ohanamascota.com

digi-plates.com

prismagtech.com

we-cinema.com

372680.com

smartautoexpert.xyz

mrxzg.com

apartment-brussels.com

reverseincubator.com

linkasean.com

yummicrabva.com

diguchaye.com

reaktorfatura.com

thecatsaysno.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/772-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2388 set thread context of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
572	772	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 264	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	30
PID 2388 wrote to memory of 264	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	30
PID 2388 wrote to memory of 264	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	30
PID 2388 wrote to memory of 264	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	30
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	31
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	31
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	31
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	31
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	31
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	31
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	31
PID 772 wrote to memory of 572	772	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	32
PID 772 wrote to memory of 572	772	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	32
PID 772 wrote to memory of 572	772	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	32
PID 772 wrote to memory of 572	772	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe"
  2⤵
  PID:264
- C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 36
    3⤵
    - Program crash
    PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/772-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/772-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/772-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2388-0-0x000000007418E000-0x000000007418F000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000001300000-0x00000000013C0000-memory.dmp

Filesize
768KB

Download
memory/2388-2-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2388-3-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/2388-4-0x000000007418E000-0x000000007418F000-memory.dmp

Filesize
4KB

Download
memory/2388-5-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2388-6-0x00000000010B0000-0x0000000001112000-memory.dmp

Filesize
392KB

Download
memory/2388-13-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download