formbook | 426ffa75739fe8c76f9b42c13944cbde5de6715394131f8e02fa83027de328f2

General

Target

c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe
Size

835KB
MD5

c33c1121b6648782476182e7364d95c0
SHA1

bdea9a1f15f73a285de33a5aeb485fbda59d912e
SHA256

426ffa75739fe8c76f9b42c13944cbde5de6715394131f8e02fa83027de328f2
SHA512

3ce494908861b9bab0c5f2fb78dabe748c197d094bcd6070e6085f16a28b4f87e2d2ec8b137e2f465aa0b8c183d22d1892333ed4cc7cd189cecd8daf3c678066
SSDEEP

12288:QyBwjP6eP9QMN6cuL7o9rMeeugDd7/a3Z77tWhw2LZT3npZCfJi/pV:QyBwjP6+v6cUo9rfmhO3Z77uB3fqc

Score

10^/10

formbook pu1i discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pu1i

Decoy

academiechaptal.com

kraftcopyagency.com

ds901.com

redtailchillisauce.com

joppamountainclub.com

online-dbm.net

nautilusfoundation.com

psm-gen.com

perpely.com

natwest-services.com

muxviet.mobi

blackmantech.loans

dominantgoal.com

sky-iron.net

sweeten-kneel.xyz

ricardoimports.com

hzzyn.com

cawholesaler.com

tgshydroponics.com

weliketopartytoronto.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4216-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4348 set thread context of 4216	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe
4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe
4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe
4216	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe
4216	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3592	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	98
PID 4348 wrote to memory of 3592	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	98
PID 4348 wrote to memory of 3592	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	98
PID 4348 wrote to memory of 4216	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	100
PID 4348 wrote to memory of 4216	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	100
PID 4348 wrote to memory of 4216	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	100
PID 4348 wrote to memory of 4216	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	100
PID 4348 wrote to memory of 4216	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	100
PID 4348 wrote to memory of 4216	4348	c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\Egwtoi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp44C4.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3592
- C:\Users\Admin\AppData\Local\Temp\c33c1121b6648782476182e7364d95c0_JaffaCakes118.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp44C4.tmp

Filesize
1KB

MD5
4f2330f39da2767bfc6bbac210b0fe2a

SHA1
18e5e1ba2b55934b852096bc29a9c6203c1e40e3

SHA256
03c6e9ce2b790e40f6c0f574fd58dd9da654cba136d72bdf06e37afd3906e6f8

SHA512
4739073bf13dfc021d3def85f847f94c3718da4a09778a293954e5dc86b313079e529bc5b41d36dc3915ba3dc0e202ac710edb62910f1f0ace153578ae2b2142

Download Submit
memory/4216-17-0x0000000001340000-0x000000000168A000-memory.dmp

Filesize
3.3MB

Download
memory/4216-16-0x0000000001340000-0x000000000168A000-memory.dmp

Filesize
3.3MB

Download
memory/4216-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4348-6-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4348-5-0x000000007518E000-0x000000007518F000-memory.dmp

Filesize
4KB

Download
memory/4348-0-0x000000007518E000-0x000000007518F000-memory.dmp

Filesize
4KB

Download
memory/4348-7-0x0000000005E90000-0x0000000005F26000-memory.dmp

Filesize
600KB

Download
memory/4348-8-0x00000000085C0000-0x0000000008642000-memory.dmp

Filesize
520KB

Download
memory/4348-9-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4348-4-0x0000000005980000-0x0000000005A12000-memory.dmp

Filesize
584KB

Download
memory/4348-3-0x00000000032A0000-0x00000000032B2000-memory.dmp

Filesize
72KB

Download
memory/4348-15-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4348-2-0x0000000005840000-0x00000000058DC000-memory.dmp

Filesize
624KB

Download
memory/4348-1-0x0000000000E10000-0x0000000000EE8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads