formbook | 1517b72d950951e2a53e5881d9f72ef224128454d1bf4ad28afbbee341787e9c

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
Size

892KB
MD5

156a8f3ff2daa772e183f33d03542088
SHA1

d5c5d9adc26f34f357bbbc04b76db5589154c096
SHA256

1517b72d950951e2a53e5881d9f72ef224128454d1bf4ad28afbbee341787e9c
SHA512

bf19dacebe4ca845683f2a0e63e03df6d93619ab8eecc7971b4554c48bbd03e0f4c796c635268261110be4d718dc8163a11c208e9d27bffacd29a8d8bf801f25
SSDEEP

12288:xLfmbbfGD5BroDcsIE++hSpk6L1S3Yp+vpVhd5FhM1wVTMsMz4AJ3sPerFfBL2qJ:xLfmbbfirrts4+ApkmAYp+vdFRtT8

Score

10^/10

formbook gbl rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gbl

Decoy

dx268.com

textbot4you.com

critictable.com

fsclub.info

order-review.com

tkgenergy.com

contavip.info

fashionests.com

sieromart.com

miamimobiletesting.com

oxforhabits.com

yugoslavilk.online

inieenterprises.com

bythebucketfranchise.com

parcelified.com

signalcyclers.com

starryeyedproject.com

proteacherstore.com

horos.tech

bovadaracebook.sucks

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 2 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/668-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook
behavioral1/memory/668-14-0x0000000000860000-0x0000000000B63000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe

description pid process target process

PID 2232 set thread context of 668 2232 156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe 156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe

pid process

668 156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/668-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/668-14-0x0000000000860000-0x0000000000B63000-memory.dmp	formbook

description	pid	process	target process
PID 2232 set thread context of 668	2232	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe

pid	process
668	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe

description	pid	process	target process
PID 2232 wrote to memory of 668	2232	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
PID 2232 wrote to memory of 668	2232	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
PID 2232 wrote to memory of 668	2232	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
PID 2232 wrote to memory of 668	2232	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
PID 2232 wrote to memory of 668	2232	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
PID 2232 wrote to memory of 668	2232	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
PID 2232 wrote to memory of 668	2232	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe	156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2232

C:\Users\Admin\AppData\Local\Temp\156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\156a8f3ff2daa772e183f33d03542088_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:668

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/668-14-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download
memory/668-13-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download
memory/668-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/668-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/668-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2232-3-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/2232-6-0x0000000000450000-0x00000000004BC000-memory.dmp

Filesize
432KB

Download
memory/2232-5-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2232-4-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/2232-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/2232-12-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2232-2-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2232-1-0x0000000000CE0000-0x0000000000DC4000-memory.dmp

Filesize
912KB

Download