formbook | 9e3a55fb3dc6ecda84471b6b425259095f7237c607f5843af1582ecd0eddd624

Resubmissions

09/07/2026, 03:26

09/07/2026, 03:17

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 03:17

Target
Secur32.dll
Size 1.7MB
Sample260709-dtcfjac14w
SHA256 9e3a55fb3dc6ecda84471b6b425259095f7237c607f5843af1582ecd0eddd624
MD5 63f0a90d02a53d468fd0084f01f5c051
SHA1 9f064fac0e6fefc09338717338946002ee442d44
SHA512 b5375be87ea9d1004a4b84d2b9ec880d5626cb5c2e7c33f6f2e14dd4383ef826a6bca2f0da572c63ef69cd67bf155bfd6f8a941c66ceb22ccbaacaf3491de3fa
SSDEEP 49152:9OIJuS9PLmA0J5UNFdl4ol08rPbnU95svl/VcWRv7klw60ao4Z:dNLmoJ4L8rjU95svl/VcWRv7klw60ao+
TLSH
T15385BE09B3C41AA9D91AC535C72B9632C2B2F8520B71D5CF1A99E70E1F37B915F3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4908-2-0x0000000000C30000-0x0000000000C76000-memory.dmp	family_formbook
behavioral2/memory/4908-6-0x0000000000C30000-0x0000000000C76000-memory.dmp	family_formbook

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32.exe	rundll32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Secur32.dll	rundll32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32.exe	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 4908	2040	rundll32.exe	84

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4908	2040	rundll32.exe	84
PID 2040 wrote to memory of 4908	2040	rundll32.exe	84
PID 2040 wrote to memory of 4908	2040	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Secur32.dll,#1
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908

memory/4908-2-0x0000000000C30000-0x0000000000C76000-memory.dmp

Download

memory/4908-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4908-4-0x00000000011B0000-0x00000000014FA000-memory.dmp

Download

memory/4908-5-0x0000000000C30000-0x0000000000C76000-memory.dmp

Download

memory/4908-6-0x0000000000C30000-0x0000000000C76000-memory.dmp

Download