formbook | f730752f0004b350ae3feabc65cad92908079f4ced927cf320228621eec9bac8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
Size

703KB
MD5

17af5975861e3433513e09c2a9fe5058
SHA1

261d0692b7d0aee53537fe63742a5d67d99c0309
SHA256

f730752f0004b350ae3feabc65cad92908079f4ced927cf320228621eec9bac8
SHA512

df8c8822ea2a876e22cd6b2af0fa2ad32872f6472e0e4dc58bfd74f355f69a534e2daaec1d812b63da04547a3af5d0933884f7dc58849094e6231a42bf0ec535
SSDEEP

12288:HZi9709qmdSUeRbZCzWBe4CUDhB8ylisVFtAHLO15IRoULHLpev6Gqr1spGntWr9:HZL3mbZAW9Co0yjAw6Hr1yGtWr9

Score

10^/10

formbook aky rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

aky

Decoy

jeiksaoeklea.com

sagame-auto.net

soloseriolavoro.com

thecreatorsbook.com

superskritch.com

oroxequipment.com

heart-of-art.online

liwedfg.com

fisherofsouls.com

jota.xyz

nehyam.com

smart-contact-delivery.com

hoom.guru

dgryds.com

thesoakcpd.com

mishv.com

rings-factory.info

bero-craft-beers.com

podcastnamegenerators.com

856379813.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/1780-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

description pid process target process

PID 2624 set thread context of 1780 2624 17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe 17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

pid process

1780 17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
1780 17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/1780-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

description	pid	process	target process
PID 2624 set thread context of 1780	2624	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

pid	process
1780	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
1780	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

description	pid	process	target process
PID 2624 wrote to memory of 1780	2624	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2624 wrote to memory of 1780	2624	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2624 wrote to memory of 1780	2624	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2624 wrote to memory of 1780	2624	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2624 wrote to memory of 1780	2624	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
PID 2624 wrote to memory of 1780	2624	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe	17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\17af5975861e3433513e09c2a9fe5058_JaffaCakes118.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1780-14-0x0000000000EF0000-0x000000000123A000-memory.dmp

Filesize
3.3MB

Download
memory/2624-6-0x0000000007980000-0x000000000798A000-memory.dmp

Filesize
40KB

Download
memory/2624-3-0x0000000004E30000-0x0000000004EC2000-memory.dmp

Filesize
584KB

Download
memory/2624-5-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/2624-4-0x0000000004D90000-0x0000000004D9A000-memory.dmp

Filesize
40KB

Download
memory/2624-0-0x000000007445E000-0x000000007445F000-memory.dmp

Filesize
4KB

Download
memory/2624-7-0x000000007445E000-0x000000007445F000-memory.dmp

Filesize
4KB

Download
memory/2624-8-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/2624-9-0x0000000007B60000-0x0000000007BE2000-memory.dmp

Filesize
520KB

Download
memory/2624-10-0x0000000007C80000-0x0000000007D1C000-memory.dmp

Filesize
624KB

Download
memory/2624-2-0x00000000053E0000-0x0000000005984000-memory.dmp

Filesize
5.6MB

Download
memory/2624-13-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/2624-1-0x0000000000460000-0x0000000000516000-memory.dmp

Filesize
728KB

Download