formbook | 17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c

General

Target

185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
Size

744KB
MD5

185ee8d153bc97bd21cf3baef478dec0
SHA1

82d941989e8feba6a6c25b8e6812b8e22be51fd3
SHA256

17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c
SHA512

38de1cff02350f6ac7acc0a3fadb0029c33368465af9b75806fe2627eb12eafbb1fdceea749f37af70263fac04a1ceefc902344eb5b8338eb3f171f6f01d3c41
SSDEEP

12288:TQirjDMcnoE0LtEx6UxNqj+stiD5mKsmlNy53tlRRm/YNUzn:TQuD1t0LtExjqj+wwctmS3t8QN

Score

10^/10

formbook grv rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

grv

Decoy

morganofatlanta.com

vz473.com

hengetelt.com

bailcally.com

virtuosoonline.com

tenthousandli.com

ohanamascota.com

digi-plates.com

prismagtech.com

we-cinema.com

372680.com

smartautoexpert.xyz

mrxzg.com

apartment-brussels.com

reverseincubator.com

linkasean.com

yummicrabva.com

diguchaye.com

reaktorfatura.com

thecatsaysno.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/772-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

description pid process target process

PID 2388 set thread context of 772 2388 185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe 185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

572 772 WerFault.exe 185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

pid process

2388 185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
2388 185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
2388 185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2388 185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/772-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

description	pid	process	target process
PID 2388 set thread context of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

pid	pid_target	process	target process
572	772	WerFault.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

pid	process
2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388

C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe"
2⤵
PID:264

C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 36
3⤵
- Program crash
PID:572

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/772-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/772-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/772-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2388-0-0x000000007418E000-0x000000007418F000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000001300000-0x00000000013C0000-memory.dmp

Filesize
768KB

Download
memory/2388-2-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2388-3-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/2388-4-0x000000007418E000-0x000000007418F000-memory.dmp

Filesize
4KB

Download
memory/2388-5-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2388-6-0x00000000010B0000-0x0000000001112000-memory.dmp

Filesize
392KB

Download
memory/2388-13-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2388 wrote to memory of 264	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 264	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 264	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 264	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 2388 wrote to memory of 772	2388	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe
PID 772 wrote to memory of 572	772	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	WerFault.exe
PID 772 wrote to memory of 572	772	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	WerFault.exe
PID 772 wrote to memory of 572	772	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	WerFault.exe
PID 772 wrote to memory of 572	772	185ee8d153bc97bd21cf3baef478dec0_JaffaCakes118.exe	WerFault.exe

Analysis

Sharing