formbook | e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd

Analysis

max time kernel
98s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2025, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
Size 1.2MB
Sample250905-sbr6layms3
SHA256 e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd
MD5 ee5dbba0af854f6dcf875a1c0aa9cc46
SHA1 135116cc8866a16a6ab3e6c54b90b556281b88fd
SHA512 dfe9b4777a2e42bbe50f5403a780ee87eb968010eae51c1d7372b0f5d54122d47d70b54393122ea87e019b46eafb985806901196218879d28adff89170744856
SSDEEP 24576:e5EmXFtKaL4/oFe5T9yyXYfP1ijXdaGMoA32+MHpaHZz:ePVt/LZeJbInQRaGQOa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery formbook rat spyware stealer trojan

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/3204-19-0x0000000000400000-0x0000000000448000-memory.dmp	family_formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 324 set thread context of 3204	324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe
3204	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 3204	324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	84
PID 324 wrote to memory of 3204	324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	84
PID 324 wrote to memory of 3204	324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	84
PID 324 wrote to memory of 3204	324	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	84

C:\Users\Admin\AppData\Local\Temp\e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
"C:\Users\Admin\AppData\Local\Temp\e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut9A5C.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut9A5C.tmp
Size 287KB
SHA256 e126ee02dfff66d8a7c6ac64b3be5c66992cf9e23bbcb9ad762916ecd850d5f5
MD5 4190f3bf760c6be02158ee20e12a85c6
SHA1 94fda4b1293e91bbcfb9bb37579db1cddf9009a5
SHA512 d2b33999032454deede5ef612af82ddfecc0eaf2f8aa2cb8e27832eaa8601204dbf0db04564014321d225fbfe4e364957e6d0be998032b5c727438b3e40b71f0
SSDEEP 6144:csmSWCd8WeQ9EZZkrC8L4JJ5+iHrdRmY8yavvj8dZMLhw3:czSWCWCEZICG4J+Yrjm98b3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/324-14-0x00000000010E0000-0x00000000014E0000-memory.dmp

Download

memory/3204-15-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3204-16-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3204-17-0x0000000001200000-0x000000000154A000-memory.dmp

Download

memory/3204-18-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3204-19-0x0000000000400000-0x0000000000448000-memory.dmp

Download