formbook | c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
Size

420KB
MD5

8881c8955f0fd9d56453761f4ec30650
SHA1

54dbf85c651292408517e3988b9715b977217294
SHA256

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e
SHA512

5a33c1590e395523b46fa6ee08319c5e9783e233eed64b92a8f68b2a7b8e321bcfae37bdd9eb23c87bca663f48cbd4e66bf9768471672e680a9e70d1fbc6f774
SSDEEP

6144:JwrMUTpmlTBl76qjNLxWC7n8zfCzl/8dhMGGn+p9z:KzklT2qjNLxWC4WzR8a+

Score

10^/10

formbook cu discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

Decoy

szmsdwl.com

sansurftowntesting.rocks

mixingtheworld.com

jagadhribartanbhandar.com

albanypieshop.com

tago.ltd

lmwellnessgroup.com

xn--vb0bj6jvrexvt.com

180pe.com

1l1threecome.men

visualgraphicarts.science

ecofitlife.com

kearneygeneralcontracting.com

stmarysbandclub.info

jinshucaijing.com

mariahdawson.com

tophoteluniverse.com

yastudent.com

fastrautoservice.com

fslgt.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2464-8-0x0000000000400000-0x0000000000469000-memory.dmp	formbook

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2464	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
2464	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5112	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
2464	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2464	5112	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe	86
PID 5112 wrote to memory of 2464	5112	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe	86
PID 5112 wrote to memory of 2464	5112	8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8881c8955f0fd9d56453761f4ec30650_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
123B

MD5
6bf517432f65eb7f0d18d574bf14124c

SHA1
5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

SHA256
6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

SHA512
7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

Download Submit
memory/2464-9-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/2464-8-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2464-11-0x000000001FF80000-0x00000000202CA000-memory.dmp

Filesize
3.3MB

Download
memory/5112-3-0x0000000077441000-0x0000000077561000-memory.dmp

Filesize
1.1MB

Download