formbook | 184f46651603fccccbba6ab8283a1551c8b41213e1b2522493e4b309e5ffcf56

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
Size

637KB
MD5

136cd3003a8ca3ad6c454a4bfce0525f
SHA1

bea4e7267de00e10524b0d06de24abdd527188f9
SHA256

184f46651603fccccbba6ab8283a1551c8b41213e1b2522493e4b309e5ffcf56
SHA512

d4d3d99d34a0e9a10c27d7c6e519b19218eee29d13fe274243351e4636d1aa8a0efb12266ab0d079d4cbcfa1dbfd3315b8f4e305b2774d133daf4f5798aad248
SSDEEP

12288:6fnbQ+X8+UiDLbRHahW0gZvL7zbRAJEc2vLYitEUspMif+q3eCEAxa+n1pw:cbQ+X8+UiDLbRHahWDZ3Hc2vvWM0+SeE

Score

10^/10

formbook bkye rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bkye

Decoy

lawnandgardenzone.com

eazymoneyindia.com

macroscopicsystem.com

aocsw.com

maisonetjardinltd.com

khadijahtv.com

shashameneland.com

kildebasen.com

lovetxts.com

easycompanyarmory.com

surviveit.info

greenterra.solutions

ushergiving.com

stickyickybakery.com

pyesquard.com

dailyinformerblog.com

thekimchilife.com

rainbow-bm.com

bosonetwork.com

bestacnetreatmentever.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/4808-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

description pid process target process

PID 1512 set thread context of 4808 1512 136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe 136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

pid process

4808 136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
4808 136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/4808-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

description	pid	process	target process
PID 1512 set thread context of 4808	1512	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

pid	process
4808	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
4808	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

description	pid	process	target process
PID 1512 wrote to memory of 4808	1512	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 1512 wrote to memory of 4808	1512	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 1512 wrote to memory of 4808	1512	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 1512 wrote to memory of 4808	1512	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 1512 wrote to memory of 4808	1512	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
PID 1512 wrote to memory of 4808	1512	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe	136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\136cd3003a8ca3ad6c454a4bfce0525f_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-6-0x00000000079F0000-0x0000000007A8C000-memory.dmp

Filesize
624KB

Download
memory/1512-8-0x000000007503E000-0x000000007503F000-memory.dmp

Filesize
4KB

Download
memory/1512-2-0x0000000005620000-0x0000000005BC4000-memory.dmp

Filesize
5.6MB

Download
memory/1512-3-0x0000000005070000-0x0000000005102000-memory.dmp

Filesize
584KB

Download
memory/1512-4-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

Filesize
40KB

Download
memory/1512-5-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/1512-1-0x0000000000580000-0x0000000000626000-memory.dmp

Filesize
664KB

Download
memory/1512-7-0x0000000007960000-0x000000000796C000-memory.dmp

Filesize
48KB

Download
memory/1512-0-0x000000007503E000-0x000000007503F000-memory.dmp

Filesize
4KB

Download
memory/1512-9-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/1512-10-0x0000000007E60000-0x0000000007EC8000-memory.dmp

Filesize
416KB

Download
memory/1512-11-0x0000000007FF0000-0x0000000008026000-memory.dmp

Filesize
216KB

Download
memory/1512-14-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/4808-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4808-15-0x0000000001250000-0x000000000159A000-memory.dmp

Filesize
3.3MB

Download