formbook | 001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe
Size 1.2MB
Sample260527-vd71yaft5v
SHA256 001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd
MD5 17a574a95bf06150007386f37a68515d
SHA1 aa7004d78cd58542b73847441836baea43291bbe
SHA512 e8f54e7c430d55a7727d1e8296fa97ee9a9a04fff6223ef6551713fadb19099ff8206e652779fd7f055d0903daeac26d4c6c3c73cdbec01b13cd6cd1f2072a36
SSDEEP 24576:g5EmXFtKaL4/oFe5T9yyXYfP1ijXdayIqvhIE1Zyvv6waf:gPVt/LZeJbInQRayJvhIEYCw
TLSH
T16E45CF027391C062FFAB91734B56F6115BBC79260123E62F13A81DB9BE701B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3380-16-0x0000000000400000-0x0000000000448000-memory.dmp	family_formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 3380	2480	001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe
3380	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2480	001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2480	001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe
2480	001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2480	001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe
2480	001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3380	2480	001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe	80

C:\Users\Admin\AppData\Local\Temp\001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe
"C:\Users\Admin\AppData\Local\Temp\001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\001f5fc4125588b5b397014241e870bd94754aba25cdd79ae484854af044becd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autD3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\autD3B.tmp
Size 286KB
SHA256 1546445bb3b05537a968cbdecd9c2e04fcc542c2604c5f48f2859fa4b387777b
MD5 18dee3ff4621eb55d492b1746f045cc9
SHA1 c682aaa26b6bf226151c32961523c4b5fb063f67
SHA512 c8c9ed8ebdd3f39b296101b178e7fd48e7970738d64a353beced5ad8e48c01dc8270403fa750ca909664f543da0448ed36d9c0411a6866bd90e1cffe748a6986
SSDEEP 6144:9DYarMEjcUQNnMn4cLvvGxZCpuRtsOhsfp2W2vheTajdN28ro:ear4U+MkOuLsYvheTajW
TLSH
T169540193E3577BF8C24307F12E78974E75960A0B08E7482E28C897D9BADE4275570D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-12-0x0000000000D10000-0x0000000001110000-memory.dmp

Download

memory/3380-13-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3380-14-0x0000000001400000-0x0000000001756000-memory.dmp

Download

memory/3380-15-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3380-16-0x0000000000400000-0x0000000000448000-memory.dmp

Download