formbook | b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
Size 991KB
Sample260810-snsmwsbr51
SHA256 b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6
MD5 6cb9744b1f3583cd6a68e2a6bcd2f76d
SHA1 047e9b6eabf6151127474b96d1e7616247025bf0
SHA512 14748195066ef9c7a6b5c88970a0c4b498012c71b84afad23f97d61417923ce031074442a55be557e61af64379d6d54cedde467e6d9e1816ca27a3dca63b7b97
SSDEEP 12288:iHFM19w+pGFSBp9DpoBYBZLG6Sue0WXN8tFBWPFb2iPZUTNR0jnAQLskfxwwLCms:iHFK9xpHBp9DpoBWC6SWGENIAQ7HLz
TLSH
T1CC2523AC76B58A13E9A96BFC46F0E53557723E8F9330D20E4ECA6CEB7461B008914713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/4488-14-0x0000000001450000-0x0000000001496000-memory.dmp	family_formbook
behavioral1/memory/4488-17-0x0000000001450000-0x0000000001496000-memory.dmp	family_formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4616	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1304	CtFBDyZDQu.exe
3392	CtFBDyZDQu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CtFBDyZDQu = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\vtrtqqcg3dm.ps1\""	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 4488	2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe	88
PID 1304 set thread context of 3392	1304	CtFBDyZDQu.exe	103

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5108	4488	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CtFBDyZDQu.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
4488	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
4616	powershell.exe
4616	powershell.exe
1304	CtFBDyZDQu.exe
1304	CtFBDyZDQu.exe
3392	CtFBDyZDQu.exe
3392	CtFBDyZDQu.exe
3392	CtFBDyZDQu.exe
3392	CtFBDyZDQu.exe
3392	CtFBDyZDQu.exe
3392	CtFBDyZDQu.exe
3392	CtFBDyZDQu.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	1304	CtFBDyZDQu.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2072	2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe	87
PID 2320 wrote to memory of 4488	2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe	88
PID 2320 wrote to memory of 4488	2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe	88
PID 2320 wrote to memory of 4488	2320	b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe	88
PID 4616 wrote to memory of 1304	4616	powershell.exe	94
PID 1304 wrote to memory of 3392	1304	CtFBDyZDQu.exe	103
PID 1304 wrote to memory of 3392	1304	CtFBDyZDQu.exe	103
PID 1304 wrote to memory of 3392	1304	CtFBDyZDQu.exe	103

C:\Users\Admin\AppData\Local\Temp\b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
"C:\Users\Admin\AppData\Local\Temp\b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
  "C:\Users\Admin\AppData\Local\Temp\b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe"
  2⤵
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe
  "C:\Users\Admin\AppData\Local\Temp\b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 184
    3⤵
    - Program crash
    PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4488 -ip 4488
1⤵
PID:640

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\vtrtqqcg3dm.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Roaming\CtFBDyZDQu.exe
  "C:\Users\Admin\AppData\Roaming\CtFBDyZDQu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Users\Admin\AppData\Roaming\CtFBDyZDQu.exe
    "C:\Users\Admin\AppData\Roaming\CtFBDyZDQu.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_b2f33nt4.qdb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b2f33nt4.qdb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

vtrtqqcg3dm.ps1

Path C:\Users\Admin\AppData\Local\Temp\vtrtqqcg3dm.ps1
Size 1KB
SHA256 263cbdb367e9022866f1f26d71fd4eb258908c8b7c206eab8415abb9138c7a73
MD5 9b15bf9e590649177cc23f81a0d29e29
SHA1 9814fa63b2bc07a040c419eac0897978b4429252
SHA512 9de867c14f63adb760a795bcbcb4c11b47f4a7eb99507959d3fc3d4f178860627451c004c77e3ea33a7e7ebdc3f5c37d37510142d729bf709f3e91da76604a7c
TLSH
T10A11A3078E9547C5406447F04A13B5CCB12E91C76B7F025099DCFA9DB32BD63382ACE8
MD5 SHA1 SHA512 TLSH

Submit Download

CtFBDyZDQu.exe

Path C:\Users\Admin\AppData\Roaming\CtFBDyZDQu.exe
Size 991KB
SHA256 b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6
MD5 6cb9744b1f3583cd6a68e2a6bcd2f76d
SHA1 047e9b6eabf6151127474b96d1e7616247025bf0
SHA512 14748195066ef9c7a6b5c88970a0c4b498012c71b84afad23f97d61417923ce031074442a55be557e61af64379d6d54cedde467e6d9e1816ca27a3dca63b7b97
SSDEEP 12288:iHFM19w+pGFSBp9DpoBYBZLG6Sue0WXN8tFBWPFb2iPZUTNR0jnAQLskfxwwLCms:iHFK9xpHBp9DpoBWC6SWGENIAQ7HLz
TLSH
T1CC2523AC76B58A13E9A96BFC46F0E53557723E8F9330D20E4ECA6CEB7461B008914713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2320-1-0x0000000006020000-0x00000000065C4000-memory.dmp

Download

memory/2320-2-0x0000000005A70000-0x0000000005B02000-memory.dmp

Download

memory/2320-3-0x0000000005D00000-0x0000000005D10000-memory.dmp

Download

memory/2320-4-0x0000000005B10000-0x0000000005B1A000-memory.dmp

Download

memory/2320-5-0x0000000005CF0000-0x0000000005CFC000-memory.dmp

Download

memory/2320-6-0x0000000005D00000-0x0000000005D10000-memory.dmp

Download

memory/2320-7-0x00000000078E0000-0x000000000797C000-memory.dmp

Download

memory/2320-8-0x0000000007980000-0x0000000007A6A000-memory.dmp

Download

memory/2320-0-0x0000000000F80000-0x000000000107E000-memory.dmp

Download

memory/4488-14-0x0000000001450000-0x0000000001496000-memory.dmp

Download

memory/4488-17-0x0000000001450000-0x0000000001496000-memory.dmp

Download

memory/4488-16-0x0000000001960000-0x0000000001CAA000-memory.dmp

Download

memory/4488-13-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4616-19-0x000001CA2B230000-0x000001CA2B240000-memory.dmp

Download

memory/4616-18-0x000001CA2B230000-0x000001CA2B240000-memory.dmp

Download

memory/4616-25-0x000001CA2D590000-0x000001CA2D5B2000-memory.dmp

Download

memory/4616-29-0x000001CA2B230000-0x000001CA2B240000-memory.dmp

Download