formbook | 40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc

General

Target

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
Size

394KB
MD5

212f0a0a7237ab09c82f6153361ac1b0
SHA1

1b84fff6041a1700f34c80a6e737e8e8c80d5770
SHA256

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc
SHA512

232d6573a5801af940f13f97adae7f6d7a7cd38a3b61b190437f666387508db5668df77db980de3b911e2dab806587f9a486ccab5887a50f27efabb538ade348
SSDEEP

12288:U1zgVlrWHFZED24Ug/Q50b4Qhw+hjcnUgtICxs3IEeC:U1zgVlrWHwi4+5Y4WzhjcnUgXpE

Score

10^/10

formbook ykj rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ykj

Decoy

polovnitelefoni.net

cateless.com

newbeginnings.club

quanghoagroup.com

pcbet0.com

normal.computer

yoinkyoink.com

lahorekabob.com

charnal-voices.com

hotsleepspot.com

thekashmirfabrics.com

upholsteryormondbeach.com

caramel-lefilm.com

pkitales.com

truancyclub.com

susanmathason.com

sweetlimenail.com

vaaudiotechnic.site

edem-agency.com

rakkonoteineinakurashi.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2468-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

description pid process target process

PID 2392 set thread context of 2468 2392 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

pid process

2392 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
2392 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
2468 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2392 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2468-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

description	pid	process	target process
PID 2392 set thread context of 2468	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

pid	process
2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
2468	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

description	pid	process	target process
PID 2392 wrote to memory of 2448	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2448	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2448	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2448	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2468	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2468	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2468	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2468	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2468	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2468	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 2392 wrote to memory of 2468	2392	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe"
2⤵
PID:2448

C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2468

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-6-0x0000000005030000-0x0000000005092000-memory.dmp

Filesize
392KB

Download
memory/2392-1-0x0000000000360000-0x00000000003C8000-memory.dmp

Filesize
416KB

Download
memory/2392-2-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2392-3-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2392-4-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download
memory/2392-5-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2392-0-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download
memory/2392-12-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2468-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2468-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2468-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2468-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2468-13-0x0000000000800000-0x0000000000B03000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing