formbook | 81e810a8629368aff2b37cd70c894140ea98fe5d701262885b423a5c8482e213

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:09

Target
918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe
Size 424KB
Sample240603-m856tscc9t
SHA256 81e810a8629368aff2b37cd70c894140ea98fe5d701262885b423a5c8482e213
MD5 918fe5ceae3805d873b0380be3f99410
SHA1 6627d751d8f7492d93d6ba2b87a6ef999cbb3c37
SHA512 48b246801998d7470c4ede2cb5bd7fc61f0413ffeb1f92b31e1304f32e7da3bd566f1ac1694b97f835fe569c24a3fb99bde51b9aa03d3cf4b9824a2a511de8a7
SSDEEP 6144:g1DU+qCHa/uAFsQ6HlG+UBr9fviw+MFgXlhG+fsHKRhWf37wwBc5+zPbGjDgNCs:OU+qPMlH8xgw+MWHbKi+3MmPbX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4756-3-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 4756	5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4756	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe
4756	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe
5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe
5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4756	5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe	87
PID 5004 wrote to memory of 4756	5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe	87
PID 5004 wrote to memory of 4756	5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe	87
PID 5004 wrote to memory of 4756	5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe	87
PID 5004 wrote to memory of 4756	5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe	87
PID 5004 wrote to memory of 4756	5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe	87
PID 5004 wrote to memory of 4756	5004	918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\918fe5ceae3805d873b0380be3f99410_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756

memory/4756-3-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5004-2-0x00000000772A1000-0x00000000773C1000-memory.dmp

Download