formbook | 75875cbf35073ab1722ae080c1c50dae2325e189a87ec1e3e6ffb8e60d34c83e

Analysis

max time kernel
298s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 00:57

Target
Πληρωμή_ATHI0.exe
Size 129KB
Sample260509-bbaswact8k
SHA256 75875cbf35073ab1722ae080c1c50dae2325e189a87ec1e3e6ffb8e60d34c83e
MD5 0e17a6290052a9e3d923b9ed9e26ce47
SHA1 aa513a6b65ab2be1b26b7bfdf6aae2419aebb29c
SHA512 ce0e3624bf31bae9a330900760b41e0a007fca02ee1067e9a7d661743b147924f9bedacce875135d633ea5527659063371fd69ed5d37ad643337966181f68ae5
SSDEEP 3072:2qAxn1bF8MgbJy8RfVPeaFuDv/s16tfpEYlKARuA0SJ:2qin18JuaqvlfSYlK6QSJ
TLSH
T141D30747B69605F4D97AD2388682A707F3B2F65D03219BCB138159AA0F737E86D39780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral4/memory/4816-7-0x0000000000B20000-0x0000000000B66000-memory.dmp	family_formbook

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Πληρωμή_ATHI0.exe	Πληρωμή_ATHI0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Πληρωμή_ATHI0.exe	Πληρωμή_ATHI0.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\base.dll	Πληρωμή_ATHI0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 640 set thread context of 4816	640	Πληρωμή_ATHI0.exe	81

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4816	640	Πληρωμή_ATHI0.exe	81
PID 640 wrote to memory of 4816	640	Πληρωμή_ATHI0.exe	81
PID 640 wrote to memory of 4816	640	Πληρωμή_ATHI0.exe	81

C:\Users\Admin\AppData\Local\Temp\Πληρωμή_ATHI0.exe
"C:\Users\Admin\AppData\Local\Temp\Πληρωμή_ATHI0.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816

memory/640-4-0x0000024AE0080000-0x0000024AE022C000-memory.dmp

Download

memory/4816-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4816-3-0x0000000000B20000-0x0000000000B66000-memory.dmp

Download

memory/4816-5-0x00000000011A0000-0x00000000014F6000-memory.dmp

Download

memory/4816-6-0x0000000000B20000-0x0000000000B66000-memory.dmp

Download

memory/4816-7-0x0000000000B20000-0x0000000000B66000-memory.dmp

Download