formbook | 79adda629a75a9542cf077e0f1b5837bba85c758b2ea31e735097097689fa0f1

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wire payment pdf.js
Size 1.9MB
Sample260415-qpr2msft6j
SHA256 79adda629a75a9542cf077e0f1b5837bba85c758b2ea31e735097097689fa0f1
MD5 8e54e9c612d3057c7f5ff6f86c15e309
SHA1 d98254b1d0653a0fa77420c52797bcf03950362d
SHA512 e2406ede635a2885d3b3617267cb5dddcf690bb318b5d55bf82f0ec04fe7eb3e873af7caee63272792655da3cdba9be15f08c3b1aa9a41cc876c8e8ef6ed9325
SSDEEP 24576:tP5qX00BZ7Pq29cINYKitO1E/Nfd1Pt3GcCHmzjVMe8/YbJGsnLPuW7aTlw7YM:IH7KIN6Nfn/NqYVpPuIH
TLSH
T17095021199C47FB9CFAC5A1C40FE150EA3F049895019798AEB73FE0BBFA7A04521B1D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/4992-15-0x0000000001010000-0x0000000001056000-memory.dmp	family_formbook
behavioral2/memory/4992-19-0x0000000001010000-0x0000000001056000-memory.dmp	family_formbook
behavioral2/memory/4992-30-0x0000000001010000-0x0000000001056000-memory.dmp	family_formbook
behavioral2/memory/1432-31-0x0000000000600000-0x0000000000643000-memory.dmp	family_formbook
behavioral2/memory/1432-38-0x0000000000600000-0x0000000000643000-memory.dmp	family_formbook

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3480	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2288	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/2288-12-0x00000188EF440000-0x00000188EF450000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 4992	2288	powershell.exe	87
PID 4992 set thread context of 3480	4992	aspnet_compiler.exe	79
PID 4992 set thread context of 1432	4992	aspnet_compiler.exe	88
PID 2288 set thread context of 3748	2288	powershell.exe	90
PID 1432 set thread context of 3480	1432	notepad.exe	79
PID 2288 set thread context of 3184	2288	powershell.exe	91
PID 2288 set thread context of 5580	2288	powershell.exe	92
PID 2288 set thread context of 3992	2288	powershell.exe	94
PID 1432 set thread context of 5400	1432	notepad.exe	93
PID 2288 set thread context of 5796	2288	powershell.exe	97
PID 2288 set thread context of 2912	2288	powershell.exe	98
PID 2288 set thread context of 5324	2288	powershell.exe	102
PID 1432 set thread context of 4004	1432	notepad.exe	99
PID 1432 set thread context of 3276	1432	notepad.exe	107

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5204	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-600123060-2148212387-2211176695-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	notepad.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
4992	aspnet_compiler.exe
4992	aspnet_compiler.exe
4992	aspnet_compiler.exe
4992	aspnet_compiler.exe
2288	powershell.exe
1432	notepad.exe
1432	notepad.exe
1432	notepad.exe
1432	notepad.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
3748	aspnet_compiler.exe
2288	powershell.exe
3184	aspnet_compiler.exe
2288	powershell.exe
5580	aspnet_compiler.exe
2288	powershell.exe
3992	aspnet_compiler.exe
2288	powershell.exe
5796	aspnet_compiler.exe
2288	powershell.exe
2912	aspnet_compiler.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
5324	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
4992	aspnet_compiler.exe
3480	wscript.exe
3480	wscript.exe
1432	notepad.exe
1432	notepad.exe
1432	notepad.exe
1432	notepad.exe
1432	notepad.exe
1432	notepad.exe
1432	notepad.exe
1432	notepad.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	5204	taskkill.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2288	3480	wscript.exe	80
PID 2288 wrote to memory of 4680	2288	powershell.exe	82
PID 2288 wrote to memory of 2088	2288	powershell.exe	83
PID 2288 wrote to memory of 1436	2288	powershell.exe	84
PID 2288 wrote to memory of 4300	2288	powershell.exe	85
PID 2288 wrote to memory of 5428	2288	powershell.exe	86
PID 2288 wrote to memory of 4992	2288	powershell.exe	87
PID 2288 wrote to memory of 4992	2288	powershell.exe	87
PID 2288 wrote to memory of 4992	2288	powershell.exe	87
PID 3480 wrote to memory of 1432	3480	wscript.exe	88
PID 2288 wrote to memory of 3304	2288	powershell.exe	89
PID 2288 wrote to memory of 3748	2288	powershell.exe	90
PID 2288 wrote to memory of 3748	2288	powershell.exe	90
PID 2288 wrote to memory of 3748	2288	powershell.exe	90
PID 2288 wrote to memory of 3184	2288	powershell.exe	91
PID 2288 wrote to memory of 3184	2288	powershell.exe	91
PID 2288 wrote to memory of 3184	2288	powershell.exe	91
PID 2288 wrote to memory of 5580	2288	powershell.exe	92
PID 2288 wrote to memory of 5580	2288	powershell.exe	92
PID 2288 wrote to memory of 5580	2288	powershell.exe	92
PID 1432 wrote to memory of 5400	1432	notepad.exe	93
PID 2288 wrote to memory of 3992	2288	powershell.exe	94
PID 2288 wrote to memory of 3992	2288	powershell.exe	94
PID 2288 wrote to memory of 3992	2288	powershell.exe	94
PID 2288 wrote to memory of 5796	2288	powershell.exe	97
PID 2288 wrote to memory of 5796	2288	powershell.exe	97
PID 2288 wrote to memory of 5796	2288	powershell.exe	97
PID 2288 wrote to memory of 2912	2288	powershell.exe	98
PID 2288 wrote to memory of 2912	2288	powershell.exe	98
PID 2288 wrote to memory of 2912	2288	powershell.exe	98
PID 1432 wrote to memory of 4004	1432	notepad.exe	99
PID 2288 wrote to memory of 4544	2288	powershell.exe	100
PID 2288 wrote to memory of 5684	2288	powershell.exe	101
PID 2288 wrote to memory of 5324	2288	powershell.exe	102
PID 2288 wrote to memory of 5324	2288	powershell.exe	102
PID 2288 wrote to memory of 5324	2288	powershell.exe	102
PID 3480 wrote to memory of 5204	3480	wscript.exe	104
PID 1432 wrote to memory of 3276	1432	notepad.exe	107

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Wire payment pdf.js"
1⤵
- Badlisted process makes network request
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_2fjKJII898Ci_1776259605949.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1436
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4300
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3304
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3748
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3184
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5796
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5324
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\SysWOW64\notepad.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4004
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3276
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_2fjKJII898Ci_1776259605949.ps1

Path C:\Temp\ps_2fjKJII898Ci_1776259605949.ps1
Size 1.4MB
SHA256 8102d74cea9d8e0f6470b1c4e04443d7b56cdee11af5f026af5908d660f24f62
MD5 2825c57fdcaabc6f697d9723a0d13920
SHA1 3d99edf2046ac5430e3ced908ecc1b181330d6b0
SHA512 8da499f9bdf4767b56e23221e6a70d9aa97c5119e4199f55188049b2a435428558980645a42ea115fe871c87409110ea5f61203c92eaca7c3ff6baa82fce223b
SSDEEP 24576:Ey+Yevp0BOfZknVQbuIDgrdcVUlZVfbdpi7tEFKGipw6dP3Hu3YCh4/GRn4TX19O:p2S6P3DOKVUhH6Gqws3HF84Z9O
TLSH
T1316533B0AACE794A0E04D22472727F2449F11A735CDE76D7594C68C71AE7F28C22F45E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gp01bjp4.11t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gp01bjp4.11t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1432-26-0x0000000000600000-0x0000000000643000-memory.dmp

Download

memory/1432-77-0x0000000000AD0000-0x0000000000B8B000-memory.dmp

Download

memory/1432-72-0x0000000000AD0000-0x0000000000B8B000-memory.dmp

Download

memory/1432-51-0x0000000000AD0000-0x0000000000B8B000-memory.dmp

Download

memory/1432-38-0x0000000000600000-0x0000000000643000-memory.dmp

Download

memory/1432-33-0x0000000000AD0000-0x0000000000B8B000-memory.dmp

Download

memory/1432-31-0x0000000000600000-0x0000000000643000-memory.dmp

Download

memory/1432-27-0x0000000000600000-0x0000000000643000-memory.dmp

Download

memory/2288-20-0x00000188D6D50000-0x00000188D6D60000-memory.dmp

Download

memory/2288-13-0x00000188EF450000-0x00000188EF456000-memory.dmp

Download

memory/2288-9-0x00000188EF1B0000-0x00000188EF1D2000-memory.dmp

Download

memory/2288-10-0x00000188D6D50000-0x00000188D6D60000-memory.dmp

Download

memory/2288-1-0x00000188D6D50000-0x00000188D6D60000-memory.dmp

Download

memory/2288-2-0x00000188D6D50000-0x00000188D6D60000-memory.dmp

Download

memory/2288-17-0x00000188D6D50000-0x00000188D6D60000-memory.dmp

Download

memory/2288-24-0x00000188D52A0000-0x00000188D52AC000-memory.dmp

Download

memory/2288-25-0x00000188D6C80000-0x00000188D6C92000-memory.dmp

Download

memory/2288-12-0x00000188EF440000-0x00000188EF450000-memory.dmp

Download

memory/2288-16-0x00000188D6D50000-0x00000188D6D60000-memory.dmp

Download

memory/3276-68-0x000001661C440000-0x000001661C55F000-memory.dmp

Download

memory/3480-23-0x0000029C1F520000-0x0000029C1F52C000-memory.dmp

Download

memory/3480-34-0x0000029C210B0000-0x0000029C211C3000-memory.dmp

Download

memory/3480-63-0x0000029C210B0000-0x0000029C211C3000-memory.dmp

Download

memory/4004-65-0x000001C45A380000-0x000001C45A46C000-memory.dmp

Download

memory/4992-30-0x0000000001010000-0x0000000001056000-memory.dmp

Download

memory/4992-14-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4992-28-0x0000000001010000-0x0000000001056000-memory.dmp

Download

memory/4992-15-0x0000000001010000-0x0000000001056000-memory.dmp

Download

memory/4992-22-0x00000000014B0000-0x00000000014D5000-memory.dmp

Download

memory/4992-21-0x0000000001010000-0x0000000001056000-memory.dmp

Download

memory/4992-19-0x0000000001010000-0x0000000001056000-memory.dmp

Download

memory/4992-18-0x0000000001500000-0x0000000001856000-memory.dmp

Download

memory/5400-49-0x000001D3AF4B0000-0x000001D3AF5CC000-memory.dmp

Download