formbook | 73aad994ee28953d8bc7e640b1f31c13cfcdaaaeaff1495083f6dcc4a7f8278a

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 13:46

Target
f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe
Size 230KB
Sample240415-q28j6aaa71
SHA256 73aad994ee28953d8bc7e640b1f31c13cfcdaaaeaff1495083f6dcc4a7f8278a
MD5 f1338d7bb4bdabe19608b96eb4b2762e
SHA1 666933a5f6d8775798907124edb1bd562225a486
SHA512 260fa39899487d5b721001a6e009a5f82c1c2a9c4821afd1fa77b2943ef82cba4de0ae3b8f9e226e477d9666fab8cff1839d78756e6968780d994f9080603e3f
SSDEEP 6144:stE5hZapab0q8aK9kDqWkuXtho4j6HvasJCyp6nzUU4Qo+:aScab1OWqWDIg6idycPc+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4492-2-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4204 set thread context of 4492	4204	f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4492	f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe
4492	f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4204	f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4492	4204	f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe	86
PID 4204 wrote to memory of 4492	4204	f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe	86
PID 4204 wrote to memory of 4492	4204	f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe	86
PID 4204 wrote to memory of 4492	4204	f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f1338d7bb4bdabe19608b96eb4b2762e_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492

memory/4204-1-0x0000000000500000-0x0000000000502000-memory.dmp

Download

memory/4204-0-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4492-2-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4492-3-0x0000000000960000-0x0000000000CAA000-memory.dmp

Download