formbook | 9994be21618e8807d281389dacb3342921fd50c6eef14168a8309961b2a60b5c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe
Size

360KB
MD5

57628c79b51d0003b7f109d59d5b947d
SHA1

dd1c9a390af61dc89d547d8bcfbec93a16724c5c
SHA256

9994be21618e8807d281389dacb3342921fd50c6eef14168a8309961b2a60b5c
SHA512

21c66fb13aa281ae2e94d1b2fb68e0d07280d18b60ba2ce77ee3920567a82c44c7cb96593a650e31554f9a328f7537181d2f6a3c6297c169f89fee8ef54e4841
SSDEEP

6144:zWFz5Ffcqt5517CiboyQ5OOW5gaGeGrHhUvqKAyDGZBPXESAOvteqLOBUf8q88uD:ziLx3U0lUhUvqKAyCvvESAz48ms2A7B9

Score

10^/10

formbook hx305 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

hx305

Decoy

mascota-pasion.com

babygeniusalquran.com

changchenglian.com

coetech.solutions

knightgrandcommander.online

incalife.online

gbps.world

telartebariloche.com

vereed.net

dublingirlo.com

yubianhuivip6.com

06518787.com

lgqcx.com

best-traffictoupdates.date

zukhyx.info

meydenbauershores.biz

holderdrumstick.com

beazahnimplantatok.live

nadinelisa.com

invirtuos.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1448-12-0x00000000005D0000-0x00000000005FA000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3156 set thread context of 1448	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe	93

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4436	3156	WerFault.exe	83
336	1448	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe
Token: 33	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1448	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe	93
PID 3156 wrote to memory of 1448	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe	93
PID 3156 wrote to memory of 1448	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe	93
PID 3156 wrote to memory of 1448	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe	93
PID 3156 wrote to memory of 1448	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe	93
PID 3156 wrote to memory of 1448	3156	57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\57628c79b51d0003b7f109d59d5b947d_JaffaCakes118.exe"
  2⤵
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 184
    3⤵
    - Program crash
    PID:336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 1048
  2⤵
  - Program crash
  PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1448 -ip 1448
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3156 -ip 3156
1⤵
PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-11-0x0000000000410000-0x0000000000430000-memory.dmp

Filesize
128KB

Download
memory/1448-12-0x00000000005D0000-0x00000000005FA000-memory.dmp

Filesize
168KB

Download
memory/3156-6-0x00000000075E0000-0x0000000007672000-memory.dmp

Filesize
584KB

Download
memory/3156-3-0x00000000074C0000-0x00000000074E0000-memory.dmp

Filesize
128KB

Download
memory/3156-4-0x0000000007A90000-0x0000000008034000-memory.dmp

Filesize
5.6MB

Download
memory/3156-5-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/3156-0-0x00000000751AE000-0x00000000751AF000-memory.dmp

Filesize
4KB

Download
memory/3156-7-0x00000000751AE000-0x00000000751AF000-memory.dmp

Filesize
4KB

Download
memory/3156-8-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/3156-9-0x00000000075D0000-0x00000000075DC000-memory.dmp

Filesize
48KB

Download
memory/3156-10-0x0000000008140000-0x00000000081DC000-memory.dmp

Filesize
624KB

Download
memory/3156-2-0x0000000004F70000-0x0000000004FA8000-memory.dmp

Filesize
224KB

Download
memory/3156-1-0x0000000000740000-0x00000000007A2000-memory.dmp

Filesize
392KB

Download
memory/3156-14-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download