formbook | faf0518430f6333ff6fe2e3c51bb69cd3a1be29511aaa8b568b96945b4ff18ed

Analysis

max time kernel
134s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 11:42

Target
2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe
Size 412KB
Sample240507-nt3b3aha36
SHA256 faf0518430f6333ff6fe2e3c51bb69cd3a1be29511aaa8b568b96945b4ff18ed
MD5 2076f3389e743659dcb4daef802479f3
SHA1 e29db627de75b18e61fcaa452b44b6609def8cb7
SHA512 828fa0929acb64f78c46476121c2053c32ee682f812fa23f98ccd9143facba38230cd0da04bef5f81935c8791bae5605a38b05e2f45586be0ff1e3370e4b4811
SSDEEP 6144:u07TDvqyS2EEBFH0WbMtg9mOYm/k+M84bCQM8475:xTDvq1C5XQq9mOr/k+M8Pd84
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4680-8-0x0000000000400000-0x0000000000467000-memory.dmp	formbook

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4680	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe
4680	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4848	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe
4680	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4680	4848	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe	84
PID 4848 wrote to memory of 4680	4848	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe	84
PID 4848 wrote to memory of 4680	4848	2076f3389e743659dcb4daef802479f3_JaffaCakes118.exe	84

win.ini

Path C:\Windows\win.ini
Size 123B
SHA256 6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
MD5 6bf517432f65eb7f0d18d574bf14124c
SHA1 5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA512 7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06
MD5 SHA1 SHA512

Submit Download

memory/4680-9-0x0000000000630000-0x0000000000636000-memory.dmp

Download

memory/4680-8-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4680-11-0x000000001FFB0000-0x00000000202FA000-memory.dmp

Download

memory/4848-3-0x0000000077551000-0x0000000077671000-memory.dmp

Download