formbook | 9adeec7138d5d6854c3632ed0560edf5566d75347ffb0b13aa441ba89aed930a

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2025, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Docs.exe
Size 1.2MB
Sample251107-d4xt8azmel
SHA256 9adeec7138d5d6854c3632ed0560edf5566d75347ffb0b13aa441ba89aed930a
MD5 395ac356edd0f2ad2e2243f20ba68f3b
SHA1 6659c39f4ac6d345c4bf110085bf8ec02fb32dd6
SHA512 1c90e0e821a3f1734470fac1dc82c88e85e579af379197af571617f41151286997808919dcf9335686d0d460de322371a8eba41522875766ebd9a5dd8de3468b
SSDEEP 24576:ftb20pkaCqT5TBWgNQ7aIsACqwRqudB1bgSpYZXt6A:cVg5tQ7aIgXU4TgcYv5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery formbook rat spyware stealer trojan

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2660-17-0x0000000000400000-0x0000000000448000-memory.dmp	family_formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1328 set thread context of 2660	1328	Docs.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Docs.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1328	Docs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1328	Docs.exe
1328	Docs.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1328	Docs.exe
1328	Docs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2660	1328	Docs.exe	86
PID 1328 wrote to memory of 2660	1328	Docs.exe	86
PID 1328 wrote to memory of 2660	1328	Docs.exe	86
PID 1328 wrote to memory of 2660	1328	Docs.exe	86

C:\Users\Admin\AppData\Local\Temp\Docs.exe
"C:\Users\Admin\AppData\Local\Temp\Docs.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Docs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut7F72.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut7F72.tmp
Size 287KB
SHA256 e0c26e810d8076d92047092dc072837cc150d0ef1c663fb2b2c1690b55540c2e
MD5 cc2165e3b40fb5d938911ff666dd993d
SHA1 5412c1fa3be289f4e147a7cd831046857a71675d
SHA512 b9a7454e4ec6d3b3bb04871ac92142296ca6e49a73c888a1ba6f2af920ce1d4879b18590313fadae6b805adad38f4ed381b7a610b1e0bd7a2391518dd8fbcc57
SSDEEP 6144:JTJy0DULmvw+zrv10RsM9JkU3v7/Xj07g5Pq8y+X1UeUa:JTj8T0z3m/T07gRyAZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1328-12-0x00000000012D0000-0x00000000016D0000-memory.dmp

Download

memory/2660-13-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2660-14-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2660-15-0x0000000001600000-0x000000000194A000-memory.dmp

Download

memory/2660-16-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2660-17-0x0000000000400000-0x0000000000448000-memory.dmp

Download