formbook | a329186a1a23e168fb7dbfc731a4c5bdc66c21e679bb904e5090f21f2db6d015

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2024, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca9241a64b855e0480f18c83a49ddc59_JaffaCakes118.exe
Size 576KB
Sample240830-lfnweaybnk
SHA256 a329186a1a23e168fb7dbfc731a4c5bdc66c21e679bb904e5090f21f2db6d015
MD5 ca9241a64b855e0480f18c83a49ddc59
SHA1 276ad8501e74e08d5200968aa2022a4a6cd5d900
SHA512 0a5a154393d656448f14cb9d6bef4a6db426c84f83e4948b0319d8ed0ecb94e62e4e75b95fd4a2c872372114396b3785c75176940541be2448cc5355127a3f77
SSDEEP 12288:QUomEFRu3xEPEGfxiPngu92Q5FwxnlDGIDmP6yW9uOQg8pxp:QmOMSPEGZwgu99qnJGIqyFMOQp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook du discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

Decoy

blackburnwork.net
stvip.net
okcpg1checkmate.mobi
bjfyzl.com
sigangbobo.info
nkphotographies.com
premierssoinsgarderie.com
magiamgiaaz.com
arven-matratze.com
sesco-hvac.com
caribbeansoul215.info
orderjuliosgourmetpizza.com
aurora-health-ua.com
fairvoyagers.com
powergraphx.com
www17703.com
grigor-dimitrov.net
ktlibs.men
practicallyblockchain.com
ijxlcp.info
dafaok666.com
handyrandyco.com
nyrugauthority.com
procraftinatorworkshop.com
americansmallbusinesses.com
zukunft-personal-austria.com
azadkashmir.net
964bifa.com
iyappan.info
mgojp.info
creators-suite.com
shengzhichen.com
lakewayroofingspecialists.info
thisisrealconsulting.com
toyotacompanyindia.com
8wgf58.info
connecssive.com
healtealife.com
xn--6iqsf491m.com
csanraxxp.com
kevin-nosworthy.com
2df-63p-ux4.biz
davccode.com
qypoker.net
alaba.site
thelilypadboutique.com
negative1386.com
anam-japan.net
wine519.com
grandsmiths.net
vrfzy.info
franck-medale.com
urbanenergyservices.com
ianchristensenmusic.net
comutile.com
glowbirdyquilts.com
mbpstudio.com
3guang.net
ppiwater.net
sxl.ink
kyushu-fes.com
t3itecnologia.com
revenbergsale.com
votesilviatrevino.net
trogmack.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4864-24-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral2/memory/4864-34-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	ca9241a64b855e0480f18c83a49ddc59_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.lnk	file.exe

Executes dropped EXE 2 IoCs

pid	Process
664	file.exe
4864	file.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 664 set thread context of 4864	664	file.exe	99
PID 4616 set thread context of 3368	4616	cmd.exe	55

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca9241a64b855e0480f18c83a49ddc59_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe
4616	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4616	cmd.exe
4616	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	file.exe
Token: SeDebugPrivilege	4616	cmd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3368	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 664	1368	ca9241a64b855e0480f18c83a49ddc59_JaffaCakes118.exe	85
PID 1368 wrote to memory of 664	1368	ca9241a64b855e0480f18c83a49ddc59_JaffaCakes118.exe	85
PID 1368 wrote to memory of 664	1368	ca9241a64b855e0480f18c83a49ddc59_JaffaCakes118.exe	85
PID 664 wrote to memory of 4864	664	file.exe	99
PID 664 wrote to memory of 4864	664	file.exe	99
PID 664 wrote to memory of 4864	664	file.exe	99
PID 664 wrote to memory of 4864	664	file.exe	99
PID 664 wrote to memory of 4864	664	file.exe	99
PID 664 wrote to memory of 4864	664	file.exe	99
PID 664 wrote to memory of 4328	664	file.exe	100
PID 664 wrote to memory of 4328	664	file.exe	100
PID 664 wrote to memory of 4328	664	file.exe	100
PID 4616 wrote to memory of 1636	4616	cmd.exe	104
PID 4616 wrote to memory of 1636	4616	cmd.exe	104
PID 4616 wrote to memory of 1636	4616	cmd.exe	104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3368
- C:\Users\Admin\AppData\Local\Temp\ca9241a64b855e0480f18c83a49ddc59_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ca9241a64b855e0480f18c83a49ddc59_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4864
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy "C:\Users\Admin\AppData\Local\Temp\RarSFX0\*.*" "C:\Users\Admin\AppData\Roaming\fan" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:4328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nwhrrxoeoaonmsiyy.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Nwhrrxoeoaonmsiyy.png
Size 25KB
SHA256 4cfd900e14e56b8b5570e9b370733d2c37da8edc8058ddf35dcb5044ae1d9e70
MD5 3891dd0974efc07cbcdc25bca0d08252
SHA1 5bb32d8dd341c6fdbb856352570ffcb60ca5a65e
SHA512 cdf55d9ebb16418df4c523dded7fb6edd618f8875f9b1e472d9ab0c9b10df3025a7d10c7d82af7081f9d8f1b0f11a6a1cd64c4ab3958bd5d8939e378a3b6f913
SSDEEP 768:XjYd+UMYm1HZ1vF8eVBeKdu0i+5/q9J6BVcs+v:XRUMN1HZ1vFzzi+cb6BKse
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uvenagxehdo.xml

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Uvenagxehdo.xml
Size 167KB
SHA256 00ac6970e7b56bed0b937613dff2213f980d311c4bbd7a1d8fda271de8727d30
MD5 4321bdacfc299dede7b38875345d0e47
SHA1 dd6bd849d1eb16a98f0b6076f9bf03001b436e7b
SHA512 189bb38c5ee0b213834fc31cf30d179d6fd1521966a4b14df31ab2d479e773f6cb7f17c3406472290eac46db38674efba7225cf234a207be45c3ec88e7614dbd
SSDEEP 3072:Tt2LmGB/uP2LKfglvZI/pNHa9WRObfbgg8HZGVY5xs/y9T78:eD/uP2mgvy769uOXgg8oYjs/yl8
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
Size 195KB
SHA256 7de138af3c37163beb8be29bd44695e0be5cba34306c94906084a0e9eb24ea7b
MD5 7573bf8132ac06b36d6687bbd37cd8fa
SHA1 a26f0a134671e69e71bff2a0f7808452473d27ea
SHA512 63ee9d40afe01761a8b08076d2e1a78961e1040e2158f65b2fde81a7411f63e26066337c84f3e7ab8d096052bf757c2226737668ef451e35212138f33be6aa05
SSDEEP 3072:x+B2UbjStB0zxgWvQf6JEv8EWhjqpNMkkJkkkkk5kYs+siPnPJSxS:o2UBgWISJKA+MkkJkkkkkCxiPnRSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/664-21-0x0000000072792000-0x0000000072793000-memory.dmp

Download

memory/664-20-0x0000000072790000-0x0000000072D41000-memory.dmp

Download

memory/664-18-0x0000000072790000-0x0000000072D41000-memory.dmp

Download

memory/664-17-0x0000000072790000-0x0000000072D41000-memory.dmp

Download

memory/664-22-0x0000000072790000-0x0000000072D41000-memory.dmp

Download

memory/664-16-0x0000000072792000-0x0000000072793000-memory.dmp

Download

memory/3368-39-0x0000000008B70000-0x0000000008C42000-memory.dmp

Download

memory/4616-33-0x0000000000D40000-0x0000000000D9A000-memory.dmp

Download

memory/4616-35-0x0000000000D40000-0x0000000000D9A000-memory.dmp

Download

memory/4864-24-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4864-34-0x0000000000400000-0x000000000042A000-memory.dmp

Download