formbook | 9adae131e047d7ab84181bedc3a26b87a7b0d9ca900f17a58280f341b7ec7dd7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
07/01/2025, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe
Size

1.5MB
MD5

540d29e5e0c8356bcc2ea32996f57893
SHA1

d29a54682754a8ddb3307e25d5a7d455ee7d77c8
SHA256

9adae131e047d7ab84181bedc3a26b87a7b0d9ca900f17a58280f341b7ec7dd7
SHA512

13cb9527ed895be247a5db89deb0c41890b220f20ed70b70f041c91d52ed20cdd0507630e39a66a68120092ad2d81a1fe5cc708fde9a3ff10bd99c772588ce7e
SSDEEP

24576:gPvGhlToPK/vx6WEHyQG87Ik/3Km8GUlVLdAKLGIQHgqs67bfSbNi/:gnWBnxSHy8Ew61lVLdnLGI0j1ahi/

Score

10^/10

formbook c249 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c249

Decoy

yourbocatubs.com

windutshop.com

kevinellis.email

hzjiya.com

theaethereal.com

charmteesgift.com

tarinikalingarayar.com

thefacesiseek.com

tehuentecnewmcc.com

xn--80ajamkdph6ax.xn--p1acf

gmodwonderlandrp.com

sincerelyenaj.com

youtuan001.com

hekimalandsurveyors.com

madhatterathletics.com

09ex.com

yogrammyraps.com

analytico-australis.com

yourhome403.com

downtown-annapolis.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2460-2-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 848 set thread context of 2460	848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2460	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2460	848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe	30
PID 848 wrote to memory of 2460	848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe	30
PID 848 wrote to memory of 2460	848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe	30
PID 848 wrote to memory of 2460	848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe	30
PID 848 wrote to memory of 2460	848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe	30
PID 848 wrote to memory of 2460	848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe	30
PID 848 wrote to memory of 2460	848	JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_540d29e5e0c8356bcc2ea32996f57893.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download