formbook | 72c5259286ef8e5e2173b3fd798015767709d8a60d84d195bba3440d197d5efb

Analysis

max time kernel
298s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO_N0_2026_ORDER.js
Size 3.1MB
Sample260721-txchpszfqa
SHA256 72c5259286ef8e5e2173b3fd798015767709d8a60d84d195bba3440d197d5efb
MD5 2291539ead4fb1f64fe9b16ff00e86fe
SHA1 ac903b037de395cc8b1c86b9baa1bbacfd508b75
SHA512 39a2d24c48f1897404876d3c8af46f9fd775513c525f36d32edb2bc55d839d4081c761e82ad7782aa813f6f07052052f2c3867c4d8c35d6117de61ba536e29f2
SSDEEP 12288:jyztysqcmd41OtJuw6af8GBotduf6cdUX2hXt0jLoP34nWWvHHdS:2ztysRmdyXrtdK6c6Mt0j/WWQ
TLSH
T195E519E720DF790F1949BA3A849D2D594FBEE0192BC3BDF1E0D60D84104E89726199EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/4536-27-0x0000000000B00000-0x0000000000B47000-memory.dmp	family_formbook
behavioral1/memory/4536-30-0x0000000000B00000-0x0000000000B47000-memory.dmp	family_formbook
behavioral1/memory/3360-32-0x00000000007B0000-0x00000000007F4000-memory.dmp	family_formbook

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
25	2608	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4960	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUpdate_ps_37rtFHkqi3hL_1784651152355.lnk	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_ps_37rtFHkqi3hL_1784651152355 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Temp\\ps_37rtFHkqi3hL_1784651152355.ps1\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_ps_37rtFHkqi3hL_1784651152355 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Temp\\ps_37rtFHkqi3hL_1784651152355.ps1\""	wscript.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 4960 set thread context of 4536	4960	powershell.exe	96
PID 4536 set thread context of 4668	4536	aspnet_compiler.exe
PID 4536 set thread context of 2608	4536	aspnet_compiler.exe	85
PID 4536 set thread context of 3360	4536	aspnet_compiler.exe	104
PID 4960 set thread context of 2444	4960	powershell.exe	107
PID 3360 set thread context of 2608	3360	getmac.exe	85
PID 4960 set thread context of 3640	4960	powershell.exe	110
PID 4960 set thread context of 4140	4960	powershell.exe	112
PID 4960 set thread context of 3236	4960	powershell.exe	114
PID 4960 set thread context of 2804	4960	powershell.exe	115

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4960	powershell.exe
4960	powershell.exe
464	powershell.exe
464	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4536	aspnet_compiler.exe
4536	aspnet_compiler.exe
4536	aspnet_compiler.exe
4536	aspnet_compiler.exe
4960	powershell.exe
4536	aspnet_compiler.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
3360	getmac.exe
3360	getmac.exe
3360	getmac.exe
3360	getmac.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
2444	aspnet_compiler.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
3640	aspnet_compiler.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4140	aspnet_compiler.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
3236	aspnet_compiler.exe
4960	powershell.exe
2804	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4536	aspnet_compiler.exe
4536	aspnet_compiler.exe
2608	wscript.exe
2608	wscript.exe
3360	getmac.exe
3360	getmac.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4960	2608	wscript.exe	86
PID 4960 wrote to memory of 3524	4960	powershell.exe	91
PID 4960 wrote to memory of 1348	4960	powershell.exe	92
PID 4960 wrote to memory of 380	4960	powershell.exe	93
PID 4960 wrote to memory of 2096	4960	powershell.exe	94
PID 4960 wrote to memory of 4704	4960	powershell.exe	95
PID 4960 wrote to memory of 4536	4960	powershell.exe	96
PID 4960 wrote to memory of 4536	4960	powershell.exe	96
PID 4960 wrote to memory of 4536	4960	powershell.exe	96
PID 2608 wrote to memory of 3360	2608	wscript.exe	104
PID 4960 wrote to memory of 648	4960	powershell.exe	106
PID 4960 wrote to memory of 2444	4960	powershell.exe	107
PID 4960 wrote to memory of 2444	4960	powershell.exe	107
PID 4960 wrote to memory of 2444	4960	powershell.exe	107
PID 4960 wrote to memory of 2888	4960	powershell.exe	109
PID 4960 wrote to memory of 3640	4960	powershell.exe	110
PID 4960 wrote to memory of 3640	4960	powershell.exe	110
PID 4960 wrote to memory of 3640	4960	powershell.exe	110
PID 4960 wrote to memory of 4844	4960	powershell.exe	111
PID 4960 wrote to memory of 4140	4960	powershell.exe	112
PID 4960 wrote to memory of 4140	4960	powershell.exe	112
PID 4960 wrote to memory of 4140	4960	powershell.exe	112
PID 4960 wrote to memory of 3496	4960	powershell.exe	113
PID 4960 wrote to memory of 3236	4960	powershell.exe	114
PID 4960 wrote to memory of 3236	4960	powershell.exe	114
PID 4960 wrote to memory of 3236	4960	powershell.exe	114
PID 4960 wrote to memory of 2804	4960	powershell.exe	115
PID 4960 wrote to memory of 2804	4960	powershell.exe	115
PID 4960 wrote to memory of 2804	4960	powershell.exe	115

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO_N0_2026_ORDER.js
1⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo -File "C:\Temp\ps_37rtFHkqi3hL_1784651152355.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1348
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:380
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:648
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2888
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4140
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3496
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3236
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2804
- C:\Windows\SysWOW64\getmac.exe
  "C:\Windows\SysWOW64\getmac.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_37rtFHkqi3hL_1784651152355.ps1

Path C:\Temp\ps_37rtFHkqi3hL_1784651152355.ps1
Size 2.2MB
SHA256 29a04ac3dedb9e9dbf0d695c2912a764166398edda6f258bd4893ba9e4fbe9b7
MD5 179e29c151e2c377bdc54e8b032fbfae
SHA1 7c3e4799f959fd4e23f1134806870de0e8dc5542
SHA512 8915f8f9ac4b5639cd3b909e72493ee06a65a317d09998ddd850a42cb22aa5bc5865e8a0b2f83aa0e99d066646c9b760d6167d0f90c7e649d17fc7cc4b33176d
SSDEEP 12288:T0No9LYRpA1MuoKC/jePVT2nHerj/1x8gpJ5iZTblqBldasuevmbRPOGiCy/hbuD:T0+9LYRpOMuByy1W0gi4
TLSH
T19AB592FA144CFDDA9AC95617CEEC9E1F82479DB794D1A0C420B6BA5E0A431FCFE08845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pp4ndjfy.mgt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pp4ndjfy.mgt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-20-0x000002D6EB910000-0x000002D6EB954000-memory.dmp

Download

memory/464-21-0x000002D6EBEB0000-0x000002D6EBF26000-memory.dmp

Download

memory/2608-39-0x000002B36DA50000-0x000002B36DB59000-memory.dmp

Download

memory/2608-34-0x000002B36DA50000-0x000002B36DB59000-memory.dmp

Download

memory/3360-31-0x00000000007B0000-0x00000000007F4000-memory.dmp

Download

memory/3360-32-0x00000000007B0000-0x00000000007F4000-memory.dmp

Download

memory/4536-27-0x0000000000B00000-0x0000000000B47000-memory.dmp

Download

memory/4536-24-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4536-30-0x0000000000B00000-0x0000000000B47000-memory.dmp

Download

memory/4960-26-0x0000029B1A1C0000-0x0000029B1A1D0000-memory.dmp

Download

memory/4960-25-0x0000029B1A1C0000-0x0000029B1A1D0000-memory.dmp

Download

memory/4960-2-0x0000029B1A1C0000-0x0000029B1A1D0000-memory.dmp

Download

memory/4960-28-0x0000029B1A1C0000-0x0000029B1A1D0000-memory.dmp

Download

memory/4960-23-0x0000029B34BE0000-0x0000029B34BF8000-memory.dmp

Download

memory/4960-22-0x0000029B1A1C0000-0x0000029B1A1D0000-memory.dmp

Download

memory/4960-9-0x0000029B34900000-0x0000029B34922000-memory.dmp

Download

memory/4960-3-0x0000029B1A1C0000-0x0000029B1A1D0000-memory.dmp

Download