formbook | 40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
Size

394KB
MD5

212f0a0a7237ab09c82f6153361ac1b0
SHA1

1b84fff6041a1700f34c80a6e737e8e8c80d5770
SHA256

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc
SHA512

232d6573a5801af940f13f97adae7f6d7a7cd38a3b61b190437f666387508db5668df77db980de3b911e2dab806587f9a486ccab5887a50f27efabb538ade348
SSDEEP

12288:U1zgVlrWHFZED24Ug/Q50b4Qhw+hjcnUgtICxs3IEeC:U1zgVlrWHwi4+5Y4WzhjcnUgXpE

Score

10^/10

formbook ykj rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ykj

Decoy

polovnitelefoni.net

cateless.com

newbeginnings.club

quanghoagroup.com

pcbet0.com

normal.computer

yoinkyoink.com

lahorekabob.com

charnal-voices.com

hotsleepspot.com

thekashmirfabrics.com

upholsteryormondbeach.com

caramel-lefilm.com

pkitales.com

truancyclub.com

susanmathason.com

sweetlimenail.com

vaaudiotechnic.site

edem-agency.com

rakkonoteineinakurashi.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/1376-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

description pid process target process

PID 748 set thread context of 1376 748 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

pid process

1376 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
1376 212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/1376-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

description	pid	process	target process
PID 748 set thread context of 1376	748	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

pid	process
1376	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
1376	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

description	pid	process	target process
PID 748 wrote to memory of 1376	748	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 748 wrote to memory of 1376	748	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 748 wrote to memory of 1376	748	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 748 wrote to memory of 1376	748	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 748 wrote to memory of 1376	748	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
PID 748 wrote to memory of 1376	748	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe	212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\212f0a0a7237ab09c82f6153361ac1b0_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-6-0x0000000004F60000-0x0000000004FB6000-memory.dmp

Filesize
344KB

Download
memory/748-8-0x0000000005030000-0x000000000503A000-memory.dmp

Filesize
40KB

Download
memory/748-2-0x0000000004D20000-0x0000000004DBC000-memory.dmp

Filesize
624KB

Download
memory/748-3-0x00000000053D0000-0x0000000005974000-memory.dmp

Filesize
5.6MB

Download
memory/748-4-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Filesize
584KB

Download
memory/748-5-0x0000000004E00000-0x0000000004E0A000-memory.dmp

Filesize
40KB

Download
memory/748-1-0x0000000000350000-0x00000000003B8000-memory.dmp

Filesize
416KB

Download
memory/748-7-0x0000000074DB0000-0x0000000075560000-memory.dmp

Filesize
7.7MB

Download
memory/748-0-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

Filesize
4KB

Download
memory/748-9-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

Filesize
4KB

Download
memory/748-10-0x0000000074DB0000-0x0000000075560000-memory.dmp

Filesize
7.7MB

Download
memory/748-11-0x0000000000C20000-0x0000000000C82000-memory.dmp

Filesize
392KB

Download
memory/748-14-0x0000000074DB0000-0x0000000075560000-memory.dmp

Filesize
7.7MB

Download
memory/1376-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1376-15-0x0000000001790000-0x0000000001ADA000-memory.dmp

Filesize
3.3MB

Download