Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-07-2024 02:39

General

  • Target

    3bb1bed04b14c0cb63dbf910a5bc3528_JaffaCakes118.exe

  • Size

    688KB

  • MD5

    3bb1bed04b14c0cb63dbf910a5bc3528

  • SHA1

    afc97fc9cef9357f783e45489f0125ddd66fa52b

  • SHA256

    66699c8f4a4f0be5c62dc4b76a719babf30cd88a0716b575ad56fd0070753c7c

  • SHA512

    74f5d51679e0ad701a765fbdf93bf7cccf995f804b134ca8fceee6ce95358d8a69943f8c840b401030597480e1192b5e9dde3f2bc15a0dc5e32e139ab1915d25

  • SSDEEP

    12288:6Zi9709qhxAySXmt5h/mgEgQgkiQ8inucai4mE3UhDpV0qZ7AYuCBm:6Z2Ahmb5rE9mqOA1yk7AYuR

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xle

Decoy

tknbr.com

loyaloneconstruction.com

what-where.com

matebacapital.com

marriedandmore.com

qiemfsolutions.com

graececonsulting.com

www7456.com

littlefreecherokeelibrary.com

tailgatepawkinglot.com

musheet.com

tesfamariamtb.com

1728025.com

xceltechuae.com

harperandchloe.com

thepamperedbarber.com

5050alberta.com

supplychainstrainer.com

lacorte.group

ringingbear.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bb1bed04b14c0cb63dbf910a5bc3528_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3bb1bed04b14c0cb63dbf910a5bc3528_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Users\Admin\AppData\Local\Temp\3bb1bed04b14c0cb63dbf910a5bc3528_JaffaCakes118.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1504-6-0x0000000005D00000-0x0000000005D0A000-memory.dmp

    Filesize

    40KB

  • memory/1504-8-0x0000000074800000-0x0000000074FB0000-memory.dmp

    Filesize

    7.7MB

  • memory/1504-2-0x0000000005EC0000-0x0000000006464000-memory.dmp

    Filesize

    5.6MB

  • memory/1504-3-0x00000000059B0000-0x0000000005A42000-memory.dmp

    Filesize

    584KB

  • memory/1504-4-0x0000000005970000-0x000000000597A000-memory.dmp

    Filesize

    40KB

  • memory/1504-5-0x0000000074800000-0x0000000074FB0000-memory.dmp

    Filesize

    7.7MB

  • memory/1504-1-0x0000000000EF0000-0x0000000000FA2000-memory.dmp

    Filesize

    712KB

  • memory/1504-7-0x000000007480E000-0x000000007480F000-memory.dmp

    Filesize

    4KB

  • memory/1504-0-0x000000007480E000-0x000000007480F000-memory.dmp

    Filesize

    4KB

  • memory/1504-9-0x0000000008320000-0x00000000083A4000-memory.dmp

    Filesize

    528KB

  • memory/1504-10-0x0000000008440000-0x00000000084DC000-memory.dmp

    Filesize

    624KB

  • memory/1504-13-0x0000000074800000-0x0000000074FB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4132-11-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/4132-14-0x0000000001080000-0x00000000013CA000-memory.dmp

    Filesize

    3.3MB

  • memory/4132-15-0x0000000001080000-0x00000000013CA000-memory.dmp

    Filesize

    3.3MB