formbook | f730752f0004b350ae3feabc65cad92908079f4ced927cf320228621eec9bac8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
Size

703KB
MD5

17af5975861e3433513e09c2a9fe5058
SHA1

261d0692b7d0aee53537fe63742a5d67d99c0309
SHA256

f730752f0004b350ae3feabc65cad92908079f4ced927cf320228621eec9bac8
SHA512

df8c8822ea2a876e22cd6b2af0fa2ad32872f6472e0e4dc58bfd74f355f69a534e2daaec1d812b63da04547a3af5d0933884f7dc58849094e6231a42bf0ec535
SSDEEP

12288:HZi9709qmdSUeRbZCzWBe4CUDhB8ylisVFtAHLO15IRoULHLpev6Gqr1spGntWr9:HZL3mbZAW9Co0yjAw6Hr1yGtWr9

Score

10^/10

formbook aky rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

aky

Decoy

jeiksaoeklea.com

sagame-auto.net

soloseriolavoro.com

thecreatorsbook.com

superskritch.com

oroxequipment.com

heart-of-art.online

liwedfg.com

fisherofsouls.com

jota.xyz

nehyam.com

smart-contact-delivery.com

hoom.guru

dgryds.com

thesoakcpd.com

mishv.com

rings-factory.info

bero-craft-beers.com

podcastnamegenerators.com

856379813.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2456-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

description pid process target process

PID 2924 set thread context of 2456 2924 17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe 17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

pid process

2456 17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2456-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

description	pid	process	target process
PID 2924 set thread context of 2456	2924	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

pid	process
2456	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

description	pid	process	target process
PID 2924 wrote to memory of 2456	2924	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2924 wrote to memory of 2456	2924	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2924 wrote to memory of 2456	2924	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2924 wrote to memory of 2456	2924	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2924 wrote to memory of 2456	2924	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2924 wrote to memory of 2456	2924	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2924 wrote to memory of 2456	2924	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2924

C:\Users\Admin\AppData\Local\Temp\17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2456

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2456-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2456-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2456-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2456-14-0x0000000000A30000-0x0000000000D33000-memory.dmp

Filesize
3.0MB

Download
memory/2924-0-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x0000000000970000-0x0000000000A26000-memory.dmp

Filesize
728KB

Download
memory/2924-2-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2924-3-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/2924-4-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2924-5-0x0000000004F20000-0x0000000004FA2000-memory.dmp

Filesize
520KB

Download
memory/2924-13-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download