formbook | 580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3

Analysis

max time kernel
100s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
05/09/2025, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe
Size 1.2MB
Sample250905-sfd5jaymz6
SHA256 580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3
MD5 f54786bd9b24d5c93082d49eb546d28d
SHA1 1d5697b9bf8e6f74eef9e351775e5dc993e150a4
SHA512 7963bcc870eb7e9b52cbe7d14e9f046d5dec7bd45b501445930c3ec38699907386ae3e6b2c6d4dc52319fda57366cfb6bbfdc0a3e3ae9dc6ac6f1e060af9e983
SSDEEP 24576:x5EmXFtKaL4/oFe5T9yyXYfP1ijXdae9SDrCri4cKL29EI+KHxQAD:xPVt/LZeJbInQRaeKCuEL2CVexQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery formbook rat spyware stealer trojan

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3240-18-0x0000000000400000-0x0000000000448000-memory.dmp	family_formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 3240	1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	1544	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe
1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe
1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 3240	1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe	78
PID 1544 wrote to memory of 3240	1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe	78
PID 1544 wrote to memory of 3240	1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe	78
PID 1544 wrote to memory of 3240	1544	580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe	78

C:\Users\Admin\AppData\Local\Temp\580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe
"C:\Users\Admin\AppData\Local\Temp\580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 756
  2⤵
  - Program crash
  PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1544 -ip 1544
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut4CD9.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut4CD9.tmp
Size 287KB
SHA256 7d988eb7c42739f9f4281e4f23b540bf16d3174a99298a67815582632df34099
MD5 334449853c59c1a7b5ac015028ceaf8d
SHA1 ce6e93ce5f243239134876b62330b273c7ad05b7
SHA512 343d6a9d4ff9c6a36a30b3c337865830814fb24ba0198dc5c4546a460870d67b330f17882c2bed754f51c85c1d9b308f31f290bf4ca3541a19ff7f2ddbfb976c
SSDEEP 6144:QCOWG1Nbxfo/SnLkLwjTN6t/HTB6TWBx1K9y:5F2NbxfhLswt6JHTAgKy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1544-14-0x0000000000F80000-0x0000000001380000-memory.dmp

Download

memory/3240-15-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3240-16-0x0000000001B00000-0x0000000001E56000-memory.dmp

Download

memory/3240-17-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3240-18-0x0000000000400000-0x0000000000448000-memory.dmp

Download