formbook | 72c5259286ef8e5e2173b3fd798015767709d8a60d84d195bba3440d197d5efb

Analysis

max time kernel
300s
max time network
212s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO_N0_2026_ORDER.js
Size 3.1MB
Sample260721-txchpszfqa
SHA256 72c5259286ef8e5e2173b3fd798015767709d8a60d84d195bba3440d197d5efb
MD5 2291539ead4fb1f64fe9b16ff00e86fe
SHA1 ac903b037de395cc8b1c86b9baa1bbacfd508b75
SHA512 39a2d24c48f1897404876d3c8af46f9fd775513c525f36d32edb2bc55d839d4081c761e82ad7782aa813f6f07052052f2c3867c4d8c35d6117de61ba536e29f2
SSDEEP 12288:jyztysqcmd41OtJuw6af8GBotduf6cdUX2hXt0jLoP34nWWvHHdS:2ztysRmdyXrtdK6c6Mt0j/WWQ
TLSH
T195E519E720DF790F1949BA3A849D2D594FBEE0192BC3BDF1E0D60D84104E89726199EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1852-25-0x0000000001460000-0x00000000014A7000-memory.dmp	family_formbook
behavioral2/memory/1852-31-0x0000000001460000-0x00000000014A7000-memory.dmp	family_formbook
behavioral2/memory/4520-33-0x0000000000EB0000-0x0000000000EF4000-memory.dmp	family_formbook

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3372	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1084	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUpdate_ps_X7AN9vDaXUhv_1784651154690.lnk	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	getmac.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_ps_X7AN9vDaXUhv_1784651154690 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Temp\\ps_X7AN9vDaXUhv_1784651154690.ps1\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_ps_X7AN9vDaXUhv_1784651154690 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Temp\\ps_X7AN9vDaXUhv_1784651154690.ps1\""	wscript.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1084 set thread context of 1852	1084	powershell.exe	99
PID 1852 set thread context of 3492	1852	aspnet_compiler.exe
PID 1852 set thread context of 3372	1852	aspnet_compiler.exe	87
PID 1852 set thread context of 4520	1852	aspnet_compiler.exe	100
PID 1084 set thread context of 1752	1084	powershell.exe	103
PID 4520 set thread context of 3372	4520	getmac.exe	87
PID 1084 set thread context of 6012	1084	powershell.exe	105
PID 1084 set thread context of 892	1084	powershell.exe	107
PID 1084 set thread context of 2360	1084	powershell.exe	109
PID 4520 set thread context of 4776	4520	getmac.exe	108

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	getmac.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1084	powershell.exe
1084	powershell.exe
5140	powershell.exe
5140	powershell.exe
5140	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1852	aspnet_compiler.exe
1852	aspnet_compiler.exe
1852	aspnet_compiler.exe
1852	aspnet_compiler.exe
1084	powershell.exe
1084	powershell.exe
1852	aspnet_compiler.exe
1084	powershell.exe
4520	getmac.exe
4520	getmac.exe
4520	getmac.exe
4520	getmac.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
1752	aspnet_compiler.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
6012	aspnet_compiler.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
892	aspnet_compiler.exe
1084	powershell.exe
2360	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1852	aspnet_compiler.exe
1852	aspnet_compiler.exe
3372	wscript.exe
3372	wscript.exe
4520	getmac.exe
4520	getmac.exe
4520	getmac.exe
4520	getmac.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	5140	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 1084	3372	wscript.exe	89
PID 1084 wrote to memory of 4848	1084	powershell.exe	94
PID 1084 wrote to memory of 248	1084	powershell.exe	95
PID 1084 wrote to memory of 260	1084	powershell.exe	96
PID 1084 wrote to memory of 4124	1084	powershell.exe	97
PID 1084 wrote to memory of 816	1084	powershell.exe	98
PID 1084 wrote to memory of 1852	1084	powershell.exe	99
PID 1084 wrote to memory of 1852	1084	powershell.exe	99
PID 1084 wrote to memory of 1852	1084	powershell.exe	99
PID 3372 wrote to memory of 4520	3372	wscript.exe	100
PID 1084 wrote to memory of 4632	1084	powershell.exe	102
PID 1084 wrote to memory of 1752	1084	powershell.exe	103
PID 1084 wrote to memory of 1752	1084	powershell.exe	103
PID 1084 wrote to memory of 1752	1084	powershell.exe	103
PID 1084 wrote to memory of 4680	1084	powershell.exe	104
PID 1084 wrote to memory of 6012	1084	powershell.exe	105
PID 1084 wrote to memory of 6012	1084	powershell.exe	105
PID 1084 wrote to memory of 6012	1084	powershell.exe	105
PID 1084 wrote to memory of 2540	1084	powershell.exe	106
PID 1084 wrote to memory of 892	1084	powershell.exe	107
PID 1084 wrote to memory of 892	1084	powershell.exe	107
PID 1084 wrote to memory of 892	1084	powershell.exe	107
PID 4520 wrote to memory of 4776	4520	getmac.exe	108
PID 1084 wrote to memory of 2360	1084	powershell.exe	109
PID 1084 wrote to memory of 2360	1084	powershell.exe	109
PID 1084 wrote to memory of 2360	1084	powershell.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	getmac.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO_N0_2026_ORDER.js
1⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo -File "C:\Temp\ps_X7AN9vDaXUhv_1784651154690.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:260
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4632
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1752
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6012
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2540
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2360
- C:\Windows\SysWOW64\getmac.exe
  "C:\Windows\SysWOW64\getmac.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:4520
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_X7AN9vDaXUhv_1784651154690.ps1

Path C:\Temp\ps_X7AN9vDaXUhv_1784651154690.ps1
Size 2.2MB
SHA256 29a04ac3dedb9e9dbf0d695c2912a764166398edda6f258bd4893ba9e4fbe9b7
MD5 179e29c151e2c377bdc54e8b032fbfae
SHA1 7c3e4799f959fd4e23f1134806870de0e8dc5542
SHA512 8915f8f9ac4b5639cd3b909e72493ee06a65a317d09998ddd850a42cb22aa5bc5865e8a0b2f83aa0e99d066646c9b760d6167d0f90c7e649d17fc7cc4b33176d
SSDEEP 12288:T0No9LYRpA1MuoKC/jePVT2nHerj/1x8gpJ5iZTblqBldasuevmbRPOGiCy/hbuD:T0+9LYRpOMuByy1W0gi4
TLSH
T19AB592FA144CFDDA9AC95617CEEC9E1F82479DB794D1A0C420B6BA5E0A431FCFE08845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 9664b478a1e6f74892648d1f9d56900fe55e882d87f24e6b02f2ada2751e8f1c
MD5 181c04132d97c84bc8d3335d5a54694e
SHA1 5ae959d0877fa254ce9c2a88ab01112243a73d05
SHA512 2fa208c7dd9f567c07465002860a809b6ee11d83447b8ff7efc7accaae7dea67805370e31f2284bed353d18bb9faa24e07a7cf7e1a8976875a3d11650eadfc8c
SSDEEP 1536:zKLgMGYo2hOovpfKQVCYXflJdpXY+inHzwqR40i71Yi9MQyPmMrxpibjoRjdvRwG:zKLgMGYo2hOovpfKQVCYXflJdlYPnHzp
TLSH
T1AE636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-18-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-29-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-7-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-9-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-45-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-4-0x000002109D0F0000-0x000002109D112000-memory.dmp

Download

memory/1084-12-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-13-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-14-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-15-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-16-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-17-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-8-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-19-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-10-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-23-0x000002109CB30000-0x000002109CB48000-memory.dmp

Download

memory/1084-30-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1084-2-0x00007FF845DBF000-0x00007FF845DC0000-memory.dmp

Download

memory/1084-3-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1852-25-0x0000000001460000-0x00000000014A7000-memory.dmp

Download

memory/1852-24-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1852-31-0x0000000001460000-0x00000000014A7000-memory.dmp

Download

memory/3372-35-0x0000023F6EF00000-0x0000023F6EFD3000-memory.dmp

Download

memory/3372-47-0x0000023F6EF00000-0x0000023F6EFD3000-memory.dmp

Download

memory/4520-32-0x0000000000EB0000-0x0000000000EF4000-memory.dmp

Download

memory/4520-33-0x0000000000EB0000-0x0000000000EF4000-memory.dmp

Download

memory/4776-46-0x0000014F13240000-0x0000014F13327000-memory.dmp

Download

memory/5140-22-0x00000203539C0000-0x0000020353A08000-memory.dmp

Download