formbook | deccbaea4951de166f83748b3ed4bd5d06b49bfe53f7106694f15c7c3102f548

Analysis

max time kernel
124s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
Size

1.1MB
MD5

b69e6e54bfcc2536be519d9cdc691b03
SHA1

3797a5718c3e7a123eb9005e8e137229b5eadb67
SHA256

deccbaea4951de166f83748b3ed4bd5d06b49bfe53f7106694f15c7c3102f548
SHA512

3cdc68e0fccdc168b70d3a380b8706bfe2362299a045bf70ae34c87f77578c503ef02ecb53895d363e2ee1dfdfc4f2645f54b7193c83374d2a77c241f03f5e77
SSDEEP

24576:+u6J33O0c+JY5UZ+XC0kGso6FaAr5eee7o2iE7zQqWY:Qu0c++OCvkGs9FaA1AvzoY

Score

10^/10

formbook re rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

Decoy

shumayuansu.com

falkerthaus.com

blondiefitness.com

lappair.reisen

miamiwindowtintingshop.com

vickeryhomesforsale.com

ohparisisburning.com

tipbong88.com

foxfarmroad.design

love-yournaturalhair.com

chanvuong.net

raw-materials-efficiency.com

negenomics.com

t0sinfe3fq.com

theconcussioninjury.com

paypalhelpservice.com

bensonsaddler.com

impcashmere.com

finddentalimplantsite.live

dianlonglawfirm.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/4252-0-0x0000000000400000-0x000000000042A000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

description pid process target process

PID 2076 set thread context of 4252 2076 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

pid process

4252 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
4252 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

pid process

2076 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
2076 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
2076 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

pid process

2076 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
2076 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
2076 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/4252-0-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

description	pid	process	target process
PID 2076 set thread context of 4252	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

pid	process
4252	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
4252	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

pid	process
2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

pid	process
2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

description	pid	process	target process
PID 2076 wrote to memory of 3436	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
PID 2076 wrote to memory of 3436	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
PID 2076 wrote to memory of 3436	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
PID 2076 wrote to memory of 4252	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
PID 2076 wrote to memory of 4252	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
PID 2076 wrote to memory of 4252	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
PID 2076 wrote to memory of 4252	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
PID 2076 wrote to memory of 4252	2076	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe	b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076

C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"
2⤵
PID:3436

C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3928,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
1⤵
PID:3508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-3-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/4252-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4252-4-0x0000000001B70000-0x0000000001EBA000-memory.dmp

Filesize
3.3MB

Download
memory/4252-5-0x0000000001B70000-0x0000000001EBA000-memory.dmp

Filesize
3.3MB

Download