formbook | 184f46651603fccccbba6ab8283a1551c8b41213e1b2522493e4b309e5ffcf56

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
Size

637KB
MD5

136cd3003a8ca3ad6c454a4bfce0525f
SHA1

bea4e7267de00e10524b0d06de24abdd527188f9
SHA256

184f46651603fccccbba6ab8283a1551c8b41213e1b2522493e4b309e5ffcf56
SHA512

d4d3d99d34a0e9a10c27d7c6e519b19218eee29d13fe274243351e4636d1aa8a0efb12266ab0d079d4cbcfa1dbfd3315b8f4e305b2774d133daf4f5798aad248
SSDEEP

12288:6fnbQ+X8+UiDLbRHahW0gZvL7zbRAJEc2vLYitEUspMif+q3eCEAxa+n1pw:cbQ+X8+UiDLbRHahWDZ3Hc2vvWM0+SeE

Score

10^/10

formbook bkye rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bkye

Decoy

lawnandgardenzone.com

eazymoneyindia.com

macroscopicsystem.com

aocsw.com

maisonetjardinltd.com

khadijahtv.com

shashameneland.com

kildebasen.com

lovetxts.com

easycompanyarmory.com

surviveit.info

greenterra.solutions

ushergiving.com

stickyickybakery.com

pyesquard.com

dailyinformerblog.com

thekimchilife.com

rainbow-bm.com

bosonetwork.com

bestacnetreatmentever.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2572-14-0x0000000000400000-0x000000000042E000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

description pid process target process

PID 2344 set thread context of 2572 2344 136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe 136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

pid process

2572 136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2572-14-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

description	pid	process	target process
PID 2344 set thread context of 2572	2344	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

pid	process
2572	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

description	pid	process	target process
PID 2344 wrote to memory of 2572	2344	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 2344 wrote to memory of 2572	2344	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 2344 wrote to memory of 2572	2344	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 2344 wrote to memory of 2572	2344	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 2344 wrote to memory of 2572	2344	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 2344 wrote to memory of 2572	2344	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 2344 wrote to memory of 2572	2344	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2344

C:\Users\Admin\AppData\Local\Temp\136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-6-0x0000000005E20000-0x0000000005E88000-memory.dmp

Filesize
416KB

Download
memory/2344-0-0x000000007474E000-0x000000007474F000-memory.dmp

Filesize
4KB

Download
memory/2344-2-0x0000000074740000-0x0000000074E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-3-0x00000000006C0000-0x00000000006CC000-memory.dmp

Filesize
48KB

Download
memory/2344-4-0x000000007474E000-0x000000007474F000-memory.dmp

Filesize
4KB

Download
memory/2344-5-0x0000000074740000-0x0000000074E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-1-0x0000000000340000-0x00000000003E6000-memory.dmp

Filesize
664KB

Download
memory/2344-7-0x0000000004B60000-0x0000000004B96000-memory.dmp

Filesize
216KB

Download
memory/2344-15-0x0000000074740000-0x0000000074E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2572-14-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2572-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2572-10-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2572-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2572-16-0x0000000000A30000-0x0000000000D33000-memory.dmp

Filesize
3.0MB

Download