formbook | 69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe
Size 1.1MB
Sample260810-sm96jsbr4s
SHA256 69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd
MD5 5a174b868ca2d317f5d9f49aa964c88c
SHA1 ee108ff77cbe984c4bb33ec1d9c16ce1577b34e7
SHA512 2625f0804c83d31c31e00fb0af76b83f6552b9f5871d60919684d9155d8f46855f97da32adce74bd1a47593cd63e53ed96afd738d9d680c4b67cb7e38fa3f3b1
SSDEEP 24576:1NK2aycKGl/VAtK0UZIKXQbKVK+qok/as2Jr+:6DyfiVAQLXaKVfqoKas2
TLSH
T12B351255ABF6EE35CA6106BF8705F6315F2E6EC58170FA8969CDBC633DBBE004400296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/5888-13-0x0000000000CD0000-0x0000000000D16000-memory.dmp	family_formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3196	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2164	SUyRiP.exe
3192	SUyRiP.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\SUyRiP = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\4mtwknhuuya.ps1\""	69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 5888	1932	69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe	89
PID 2164 set thread context of 3192	2164	SUyRiP.exe	97

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5756	5888	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SUyRiP.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5888	69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe
3196	powershell.exe
3196	powershell.exe
3196	powershell.exe
3192	SUyRiP.exe
3192	SUyRiP.exe
3192	SUyRiP.exe
3192	SUyRiP.exe
3192	SUyRiP.exe
3192	SUyRiP.exe
3192	SUyRiP.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 5888	1932	69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe	89
PID 1932 wrote to memory of 5888	1932	69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe	89
PID 1932 wrote to memory of 5888	1932	69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe	89
PID 3196 wrote to memory of 2164	3196	powershell.exe	95
PID 2164 wrote to memory of 3192	2164	SUyRiP.exe	97
PID 2164 wrote to memory of 3192	2164	SUyRiP.exe	97
PID 2164 wrote to memory of 3192	2164	SUyRiP.exe	97

C:\Users\Admin\AppData\Local\Temp\69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe
"C:\Users\Admin\AppData\Local\Temp\69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe
  "C:\Users\Admin\AppData\Local\Temp\69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 236
    3⤵
    - Program crash
    PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5888 -ip 5888
1⤵
PID:4828

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\4mtwknhuuya.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Roaming\SUyRiP.exe
  "C:\Users\Admin\AppData\Roaming\SUyRiP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Roaming\SUyRiP.exe
    "C:\Users\Admin\AppData\Roaming\SUyRiP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4mtwknhuuya.ps1

Path C:\Users\Admin\AppData\Local\Temp\4mtwknhuuya.ps1
Size 1KB
SHA256 ef34047cd12e228cdec9cc26a70e1025eaac68eb3a490bf6ce4909a72db7a822
MD5 e6bf207da3d222f1fb5c303ab8a5f696
SHA1 f58d089ba7bac34328239b56dbe8e19eb5e0192b
SHA512 f5179eebc196c0e173b17d1798e2120fa7c2f048b54635e0751dabd2eb6290da7e23083063aacdd00eb45dc4587ef83fa6aaaa5e97b0d0263760cd1ebd4abe10
TLSH
T18C21B61B9E8807D5406403E11503B2DDB61E62DF637F019059DDB5EDB36BE23386ADE4
MD5 SHA1 SHA512 TLSH

Submit Download

SUyRiP.exe

Path C:\Users\Admin\AppData\Roaming\SUyRiP.exe
Size 1.1MB
SHA256 69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd
MD5 5a174b868ca2d317f5d9f49aa964c88c
SHA1 ee108ff77cbe984c4bb33ec1d9c16ce1577b34e7
SHA512 2625f0804c83d31c31e00fb0af76b83f6552b9f5871d60919684d9155d8f46855f97da32adce74bd1a47593cd63e53ed96afd738d9d680c4b67cb7e38fa3f3b1
SSDEEP 24576:1NK2aycKGl/VAtK0UZIKXQbKVK+qok/as2Jr+:6DyfiVAQLXaKVfqoKas2
TLSH
T12B351255ABF6EE35CA6106BF8705F6315F2E6EC58170FA8969CDBC633DBBE004400296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-6-0x0000000074400000-0x0000000074BBC000-memory.dmp

Download

memory/1932-3-0x00000000057A0000-0x0000000005832000-memory.dmp

Download

memory/1932-4-0x0000000005770000-0x000000000577A000-memory.dmp

Download

memory/1932-5-0x0000000005960000-0x00000000059FC000-memory.dmp

Download

memory/1932-0-0x0000000074412000-0x0000000074413000-memory.dmp

Download

memory/1932-7-0x0000000005A00000-0x0000000005A0C000-memory.dmp

Download

memory/1932-8-0x0000000074412000-0x0000000074413000-memory.dmp

Download

memory/1932-9-0x0000000074400000-0x0000000074BBC000-memory.dmp

Download

memory/1932-10-0x0000000006D20000-0x0000000006E0A000-memory.dmp

Download

memory/1932-2-0x0000000005D60000-0x000000000631A000-memory.dmp

Download

memory/1932-1-0x0000000000B30000-0x0000000000C52000-memory.dmp

Download

memory/1932-14-0x0000000074400000-0x0000000074BBC000-memory.dmp

Download

memory/3196-21-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp

Download

memory/3196-16-0x00007FFE9C7FF000-0x00007FFE9C800000-memory.dmp

Download

memory/3196-20-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp

Download

memory/3196-19-0x0000018A3ADF0000-0x0000018A3AE12000-memory.dmp

Download

memory/3196-23-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp

Download

memory/3196-24-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp

Download

memory/3196-25-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp

Download

memory/3196-26-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp

Download

memory/3196-27-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp

Download

memory/3196-30-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp

Download

memory/5888-15-0x0000000001300000-0x0000000001674000-memory.dmp

Download

memory/5888-13-0x0000000000CD0000-0x0000000000D16000-memory.dmp

Download

memory/5888-12-0x0000000000400000-0x0000000000446000-memory.dmp

Download