formbook | eced2406f4bcba0e0e017c9215b07ac0e5b1e2a3ba962753c5cc3cca88aee9ca

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
Size

348KB
MD5

bc699327b7d8fe4f35d0128c292158c4
SHA1

bdd93c01e4e08f21997db4d436ba898291c0bf7a
SHA256

eced2406f4bcba0e0e017c9215b07ac0e5b1e2a3ba962753c5cc3cca88aee9ca
SHA512

c65f68bd98ac6512a57b0552bb450acd14b237bc59ace12fc17bbef7f3a49a4e41aac86ebc5ae3c038ca79095d22282cd0bf43bb7b40d91ab54411d0b9438fc2
SSDEEP

6144:xVGzABRwv6pZN9VOHsidU65apfSxYr9Ad:xVGzEiWZN9It55arOd

Score

10^/10

formbook hx300 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

hx300

Decoy

uniquepure.com

xn--mkr60t8otfk4a.com

npulrk.com

xzzjmy.com

3dleatherwallpanel.com

0r1twohot.men

zealtolearn.com

jokes-about.com

lomalan.com

tv17882.info

dajerkstop.com

rwzst.info

krematoriumniederrhein.com

scentprintluxury.com

embeducate.com

barbarawilliford.com

awesoppy.com

taonongwei.com

notasmallworld.net

perthmohssurgery.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/756-3-0x0000000000400000-0x000000000042A000-memory.dmp formbook
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4808 756 WerFault.exe bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
4716 756 WerFault.exe bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

pid process

756 bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
756 bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

pid process

756 bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
756 bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

pid process

756 bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
756 bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

pid process

756 bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/756-3-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

pid	pid_target	process	target process
4808	756	WerFault.exe	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
4716	756	WerFault.exe	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

pid	process
756	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
756	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

pid	process
756	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
756	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

pid	process
756	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
756	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

pid	process
756	bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 484
2⤵
- Program crash
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 480
2⤵
- Program crash
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 756 -ip 756
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 756 -ip 756
1⤵
PID:3528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-3-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/756-5-0x0000000077A41000-0x0000000077B61000-memory.dmp

Filesize
1.1MB

Download
memory/756-6-0x00000000043B0000-0x00000000046FA000-memory.dmp

Filesize
3.3MB

Download