formbook | 37f6df44b9dd38408fe5682c6d660eceb04a2915b3420576afce05bf3076bc01

General

Target

bb367436118b3298affddea50440ac12_JaffaCakes118.exe
Size

1.4MB
MD5

bb367436118b3298affddea50440ac12
SHA1

b2b8d261784991e3c14c6577447362cb6d72634c
SHA256

37f6df44b9dd38408fe5682c6d660eceb04a2915b3420576afce05bf3076bc01
SHA512

f3549647a3e17bf9ca84e67e40311c3906e9b822f25567a434f8ae7ef737d0a10057ff5812fb293f4d2375b1da15b14458b33c3bcff92eb3599512757c1d638d
SSDEEP

12288:3JdXpDQCEm+SSboh6Htaw0gjLozE+LiBUVtfX/KT2fX1k/HmUVpGF9EVxlm:3JDBCh82j0zE+LiIKT2fX1vOm

Score

10^/10

formbook kzk9 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/652-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb367436118b3298affddea50440ac12_JaffaCakes118.exe

description	pid	Process	procid_target
PID 5040 set thread context of 652	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	92

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

bb367436118b3298affddea50440ac12_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb367436118b3298affddea50440ac12_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

bb367436118b3298affddea50440ac12_JaffaCakes118.exebb367436118b3298affddea50440ac12_JaffaCakes118.exe

pid	Process
5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe
5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe
5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe
652	bb367436118b3298affddea50440ac12_JaffaCakes118.exe
652	bb367436118b3298affddea50440ac12_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bb367436118b3298affddea50440ac12_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bb367436118b3298affddea50440ac12_JaffaCakes118.exe

description	pid	Process	procid_target
PID 5040 wrote to memory of 1388	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	91
PID 5040 wrote to memory of 1388	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	91
PID 5040 wrote to memory of 1388	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	91
PID 5040 wrote to memory of 652	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	92
PID 5040 wrote to memory of 652	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	92
PID 5040 wrote to memory of 652	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	92
PID 5040 wrote to memory of 652	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	92
PID 5040 wrote to memory of 652	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	92
PID 5040 wrote to memory of 652	5040	bb367436118b3298affddea50440ac12_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\bb367436118b3298affddea50440ac12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb367436118b3298affddea50440ac12_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\bb367436118b3298affddea50440ac12_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\bb367436118b3298affddea50440ac12_JaffaCakes118.exe"
  2⤵
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\bb367436118b3298affddea50440ac12_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\bb367436118b3298affddea50440ac12_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/652-16-0x0000000001690000-0x00000000019DA000-memory.dmp

Filesize
3.3MB

Download
memory/5040-8-0x0000000004CB0000-0x0000000004CCE000-memory.dmp

Filesize
120KB

Download
memory/5040-9-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/5040-4-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Filesize
584KB

Download
memory/5040-6-0x0000000004EA0000-0x0000000004EF6000-memory.dmp

Filesize
344KB

Download
memory/5040-7-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/5040-5-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Filesize
40KB

Download
memory/5040-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/5040-3-0x0000000005220000-0x00000000057C4000-memory.dmp

Filesize
5.6MB

Download
memory/5040-10-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/5040-11-0x0000000005AD0000-0x0000000005B72000-memory.dmp

Filesize
648KB

Download
memory/5040-12-0x00000000080A0000-0x00000000080D4000-memory.dmp

Filesize
208KB

Download
memory/5040-2-0x0000000004BB0000-0x0000000004C4C000-memory.dmp

Filesize
624KB

Download
memory/5040-15-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/5040-1-0x00000000000A0000-0x000000000020A000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads