formbook | bfe8597cf704cb576063e7883146c8af4f384521ddc1ecb059d91d58480bc265

Analysis

max time kernel
149s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
04/12/2025, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Request Quotation.exe
Size 744KB
Sample251204-jd8fxsem9w
SHA256 bfe8597cf704cb576063e7883146c8af4f384521ddc1ecb059d91d58480bc265
MD5 c21f86ac794dcd6e3b03c5e41e6b6cd1
SHA1 aa35f7241b5518223cbb5ba8f33e735833725e1e
SHA512 71dc10c0eef63fece77c223abf1e04a483c0b76de3b641332d686cf0aaeb70040cbeaa6574111c83ae76a35bf6ef8b4156d88d688cb0ac68a96e492e723523e1
SSDEEP 12288:yPdiov8xzHu94dzCFnaDRUiiNoIrC1lwiUGjW/6pwf/+06Ldfz+Pv+igh8kovga2:yPdioEYmGFziimIrONjW/Dfm06lyOFqM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4916-43-0x0000000000400000-0x0000000000446000-memory.dmp	family_formbook
behavioral2/memory/3400-96-0x0000000000400000-0x0000000000446000-memory.dmp	family_formbook
behavioral2/memory/4916-117-0x0000000000400000-0x0000000000446000-memory.dmp	family_formbook
behavioral2/memory/4764-120-0x00000000007B0000-0x00000000007F4000-memory.dmp	family_formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1752	powershell.exe
5996	powershell.exe
4380	powershell.exe
2476	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5024	dooItrZHGXk.exe
5944	dooItrZHGXk.exe
3400	dooItrZHGXk.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5124-6-0x00000000057C0000-0x00000000057CE000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 5124 set thread context of 4916	5124	Request Quotation.exe	86
PID 4916 set thread context of 4628	4916	Request Quotation.exe
PID 5024 set thread context of 3400	5024	dooItrZHGXk.exe	95
PID 3400 set thread context of 4628	3400	dooItrZHGXk.exe
PID 4916 set thread context of 4628	4916	Request Quotation.exe
PID 4916 set thread context of 4764	4916	Request Quotation.exe	98
PID 3400 set thread context of 4428	3400	dooItrZHGXk.exe	97
PID 4764 set thread context of 4628	4764	runonce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dooItrZHGXk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Request Quotation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4636	schtasks.exe
5580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1752	powershell.exe
5996	powershell.exe
5124	Request Quotation.exe
5124	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
5996	powershell.exe
1752	powershell.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4380	powershell.exe
2476	powershell.exe
5024	dooItrZHGXk.exe
5024	dooItrZHGXk.exe
3400	dooItrZHGXk.exe
3400	dooItrZHGXk.exe
3400	dooItrZHGXk.exe
3400	dooItrZHGXk.exe
4380	powershell.exe
3400	dooItrZHGXk.exe
2476	powershell.exe
3400	dooItrZHGXk.exe
3400	dooItrZHGXk.exe
3400	dooItrZHGXk.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4916	Request Quotation.exe
4764	runonce.exe
4764	runonce.exe
4764	runonce.exe
4764	runonce.exe
4764	runonce.exe
4764	runonce.exe
4764	runonce.exe
4764	runonce.exe
4428	runonce.exe
4428	runonce.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4916	Request Quotation.exe
3400	dooItrZHGXk.exe
4916	Request Quotation.exe
4764	runonce.exe
4764	runonce.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	5124	Request Quotation.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	5024	dooItrZHGXk.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 1752	5124	Request Quotation.exe	78
PID 5124 wrote to memory of 5996	5124	Request Quotation.exe	80
PID 5124 wrote to memory of 4636	5124	Request Quotation.exe	82
PID 5124 wrote to memory of 4772	5124	Request Quotation.exe	85
PID 5124 wrote to memory of 4916	5124	Request Quotation.exe	86
PID 5124 wrote to memory of 4916	5124	Request Quotation.exe	86
PID 5124 wrote to memory of 4916	5124	Request Quotation.exe	86
PID 5024 wrote to memory of 4380	5024	dooItrZHGXk.exe	88
PID 5024 wrote to memory of 2476	5024	dooItrZHGXk.exe	90
PID 5024 wrote to memory of 5580	5024	dooItrZHGXk.exe	91
PID 5024 wrote to memory of 5944	5024	dooItrZHGXk.exe	94
PID 5024 wrote to memory of 3400	5024	dooItrZHGXk.exe	95
PID 5024 wrote to memory of 3400	5024	dooItrZHGXk.exe	95
PID 5024 wrote to memory of 3400	5024	dooItrZHGXk.exe	95

C:\Users\Admin\AppData\Local\Temp\Request Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Request Quotation.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Request Quotation.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5996
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dooItrZHGXk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD542.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\Request Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request Quotation.exe"
  2⤵
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\Request Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request Quotation.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4916

C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe
C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dooItrZHGXk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C6C.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5580
- C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe
  "C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe"
  2⤵
  - Executes dropped EXE
  PID:5944
- C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe
  "C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3400

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\SysWOW64\runonce.exe"
1⤵
PID:3776

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\SysWOW64\runonce.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4428

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\SysWOW64\runonce.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 990adeb42b850ef3dee2defae289b4a259185b61481fc9a7077923547d4973f9
MD5 2e5cb82e5d6732bade76a1ab99199fdd
SHA1 b11f390d10aced48f8884fb0e22206f244760630
SHA512 c7de1ca487d214fc8fec5efd054cc62287a1f36a79640f98dd4855f711b4276aa125df87f4e00aa12589a42fec304a544cd0a91c9d4212450a78335b981cc761
SSDEEP 384:/THhY1SGA7EStWlFRHEME2HTzYZaa8bwnHZO9MrR+5nYE8apDU1C:aSj1teRPEGT4DHZwM9+m2UM
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 bebc1cece562f4cea1301a99e893efb02c7bd47be72018212046838ab363f15c
MD5 91e30a453205815779c9a6018cf88908
SHA1 2f4447ff31edb5f0c0936afec5e30c7352c31174
SHA512 32b96bc7e008e027e01128797b71a9d847f49835fa02c7f1aba8dfa3b96b7f277fd27d343321bf6dbab5ae1e540e81592a3456593d4eed675c43096523c59019
SSDEEP 384:aL3HhRSS1UpxN9RgHEMEaHnnNPjs2xtgHN8u2zr9l9J0u0iFzBX:krSSC99qPEqNPj7xtgt8uKl9J0u0yt
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_tow3dbq4.flf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tow3dbq4.flf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpD542.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD542.tmp
Size 1KB
SHA256 c200224e4f35d47f319b9c39ae1e1e8415c8fc8ac59ec58cc802aac71175e764
MD5 7ddbef94ba314a0ba1594bce0cbf4e28
SHA1 e2938d779d091c679f6cd8e21c70c13d77a26c71
SHA512 621ba638dd7f9b47657a70b810263542b1aeca9f4a97ec52f37873d4d1fd2e83ae324546b18337ba6398321f973004d526ce6c9dd8b0ca0b952e706de7c004df
MD5 SHA1 SHA512

Submit Download

dooItrZHGXk.exe

Path C:\Users\Admin\AppData\Roaming\dooItrZHGXk.exe
Size 744KB
SHA256 bfe8597cf704cb576063e7883146c8af4f384521ddc1ecb059d91d58480bc265
MD5 c21f86ac794dcd6e3b03c5e41e6b6cd1
SHA1 aa35f7241b5518223cbb5ba8f33e735833725e1e
SHA512 71dc10c0eef63fece77c223abf1e04a483c0b76de3b641332d686cf0aaeb70040cbeaa6574111c83ae76a35bf6ef8b4156d88d688cb0ac68a96e492e723523e1
SSDEEP 12288:yPdiov8xzHu94dzCFnaDRUiiNoIrC1lwiUGjW/6pwf/+06Ldfz+Pv+igh8kovga2:yPdioEYmGFziimIrONjW/Dfm06lyOFqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1752-45-0x00000000711C0000-0x000000007120C000-memory.dmp

Download

memory/1752-65-0x0000000007960000-0x0000000007971000-memory.dmp

Download

memory/1752-42-0x0000000006800000-0x000000000684C000-memory.dmp

Download

memory/1752-41-0x0000000006400000-0x000000000641E000-memory.dmp

Download

memory/1752-14-0x0000000002C10000-0x0000000002C46000-memory.dmp

Download

memory/1752-16-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

Download

memory/1752-15-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

Download

memory/1752-17-0x00000000055E0000-0x0000000005C0A000-memory.dmp

Download

memory/1752-67-0x00000000079A0000-0x00000000079B5000-memory.dmp

Download

memory/1752-44-0x00000000069F0000-0x0000000006A24000-memory.dmp

Download

memory/1752-63-0x00000000077D0000-0x00000000077DA000-memory.dmp

Download

memory/1752-21-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/1752-23-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Download

memory/1752-22-0x0000000005D80000-0x0000000005DE6000-memory.dmp

Download

memory/1752-62-0x0000000007750000-0x000000000776A000-memory.dmp

Download

memory/1752-53-0x00000000075F0000-0x0000000007694000-memory.dmp

Download

memory/1752-29-0x0000000005F50000-0x00000000062A7000-memory.dmp

Download

memory/1752-52-0x00000000069C0000-0x00000000069DE000-memory.dmp

Download

memory/2476-105-0x0000000075830000-0x000000007587C000-memory.dmp

Download

memory/3400-96-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4380-77-0x0000000005B20000-0x0000000005E77000-memory.dmp

Download

memory/4380-95-0x0000000006100000-0x000000000614C000-memory.dmp

Download

memory/4380-113-0x0000000007660000-0x0000000007675000-memory.dmp

Download

memory/4380-112-0x0000000007620000-0x0000000007631000-memory.dmp

Download

memory/4380-104-0x0000000007290000-0x0000000007334000-memory.dmp

Download

memory/4380-97-0x0000000075830000-0x000000007587C000-memory.dmp

Download

memory/4764-120-0x00000000007B0000-0x00000000007F4000-memory.dmp

Download

memory/4764-118-0x00000000007B0000-0x00000000007F4000-memory.dmp

Download

memory/4916-43-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4916-31-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4916-117-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5124-3-0x0000000005730000-0x0000000005740000-memory.dmp

Download

memory/5124-5-0x00000000057E0000-0x000000000587C000-memory.dmp

Download

memory/5124-4-0x0000000005510000-0x000000000551A000-memory.dmp

Download

memory/5124-1-0x0000000005B00000-0x00000000060A6000-memory.dmp

Download

memory/5124-0-0x00000000009C0000-0x0000000000A7E000-memory.dmp

Download

memory/5124-2-0x0000000005550000-0x00000000055E2000-memory.dmp

Download

memory/5124-7-0x0000000005730000-0x0000000005740000-memory.dmp

Download

memory/5124-6-0x00000000057C0000-0x00000000057CE000-memory.dmp

Download

memory/5124-9-0x0000000007670000-0x00000000076F8000-memory.dmp

Download

memory/5124-8-0x0000000005730000-0x0000000005740000-memory.dmp

Download

memory/5996-64-0x0000000007080000-0x0000000007116000-memory.dmp

Download

memory/5996-18-0x0000000002200000-0x0000000002210000-memory.dmp

Download

memory/5996-66-0x0000000007030000-0x000000000703E000-memory.dmp

Download

memory/5996-19-0x0000000002200000-0x0000000002210000-memory.dmp

Download

memory/5996-69-0x0000000007130000-0x0000000007138000-memory.dmp

Download

memory/5996-61-0x0000000007440000-0x0000000007ABA000-memory.dmp

Download

memory/5996-54-0x00000000711C0000-0x000000007120C000-memory.dmp

Download

memory/5996-68-0x0000000007140000-0x000000000715A000-memory.dmp

Download