formbook | c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
Size

420KB
MD5

8881c8955f0fd9d56453761f4ec30650
SHA1

54dbf85c651292408517e3988b9715b977217294
SHA256

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e
SHA512

5a33c1590e395523b46fa6ee08319c5e9783e233eed64b92a8f68b2a7b8e321bcfae37bdd9eb23c87bca663f48cbd4e66bf9768471672e680a9e70d1fbc6f774
SSDEEP

6144:JwrMUTpmlTBl76qjNLxWC7n8zfCzl/8dhMGGn+p9z:KzklT2qjNLxWC4WzR8a+

Score

10^/10

formbook cu discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

Decoy

szmsdwl.com

sansurftowntesting.rocks

mixingtheworld.com

jagadhribartanbhandar.com

albanypieshop.com

tago.ltd

lmwellnessgroup.com

xn--vb0bj6jvrexvt.com

180pe.com

1l1threecome.men

visualgraphicarts.science

ecofitlife.com

kearneygeneralcontracting.com

stmarysbandclub.info

jinshucaijing.com

mariahdawson.com

tophoteluniverse.com

yastudent.com

fastrautoservice.com

fslgt.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2304-9-0x0000000000400000-0x0000000000469000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 2304	3016	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe	30

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2304	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3016	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
2304	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2304	3016	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2304	3016	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2304	3016	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2304	3016	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
memory/2304-10-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2304-9-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2304-12-0x0000000077B60000-0x0000000077D09000-memory.dmp

Filesize
1.7MB

Download
memory/3016-3-0x0000000077B61000-0x0000000077C62000-memory.dmp

Filesize
1.0MB

Download
memory/3016-4-0x0000000077B60000-0x0000000077D09000-memory.dmp

Filesize
1.7MB

Download
memory/3016-11-0x0000000077D50000-0x0000000077E26000-memory.dmp

Filesize
856KB

Download