formbook | 756e86098fce299eb7c117b5175523e36fb1966ef9347e1c8bfc017c378bd883

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO# 4508555536.js
Size 556KB
Sample260820-mt3gdsx1ht
SHA256 756e86098fce299eb7c117b5175523e36fb1966ef9347e1c8bfc017c378bd883
MD5 2b26ce6deeeb04bf473b3970799a76fa
SHA1 2a207aadbd271f4fe4a9f4b522c1dddf49334c15
SHA512 971a2b59dc5459e144171dde3e66d45d747f6add25223837fc7eab6bf074f82d06242ffeaf9e8e9230a91c7d6181134ed13f97db8f2362bf9dcd3e5688b000ac
SSDEEP 6144:flymVb99N8kmi4O50v8qMXBmN+mOCxYojHVKd4iTPN:LnN8kmiwv8q8Bi+mOuYmV04w
TLSH
T1FBC4462B472DF5153420BC10978E64B1B2EDC98F4F5E05E6194EE8FCAF86924C0D7AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4544-16-0x00000000011D0000-0x0000000001216000-memory.dmp	family_formbook
behavioral2/memory/4544-17-0x00000000011D0000-0x0000000001216000-memory.dmp	family_formbook
behavioral2/memory/4544-18-0x00000000011D0000-0x0000000001216000-memory.dmp	family_formbook

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	6068	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6068	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 6068 set thread context of 4544	6068	powershell.exe	97
PID 4544 set thread context of 2572	4544	CasPol.exe
PID 4544 set thread context of 2572	4544	CasPol.exe
PID 4544 set thread context of 2572	4544	CasPol.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4544	CasPol.exe
4544	CasPol.exe
4544	CasPol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6068	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
704	conhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 3532	704	conhost.exe	93
PID 6116 wrote to memory of 6068	6116	conhost.exe	95
PID 6068 wrote to memory of 4544	6068	powershell.exe	97
PID 6068 wrote to memory of 4544	6068	powershell.exe	97
PID 6068 wrote to memory of 4544	6068	powershell.exe	97
PID 6068 wrote to memory of 4544	6068	powershell.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO# 4508555536.js"
1⤵
PID:4072

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3532

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2536

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\i00mt1eartr\i00mt1eartr.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\i00mt1eartr\i00mt1eartr.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i00mt1eartr.ps1

Path C:\Users\Admin\AppData\Local\Temp\i00mt1eartr\i00mt1eartr.ps1
Size 1KB
SHA256 60587dab1939de74bdce1f1699efc940270dcde49af68454cfedd30eea372c17
MD5 224465e7bbf0ff483c39fbdd313f7163
SHA1 784eabbc92169c214828d5f41848a4654b825a8c
SHA512 8d3aa469c647258793a1e99d66536ce2530d5a4ef98ccb733ba90aa95f2310b6548c5e7d583bf5b4c71366c8ad16ba6f0e3c553cf9e981fbc49531d02a4c64c3
TLSH
T17331457242C3D91D01F486536D726A8DD9B8880CB68F6BD1F783C954324E64ABBD078B
MD5 SHA1 SHA512 TLSH

Submit Download

i00mt1eartra

Path C:\Users\Admin\AppData\Local\Temp\i00mt1eartr\i00mt1eartra
Size 68KB
SHA256 81d8279ad85a2c3a2c2470a2a970181b4afd0aaca422fab02872aa96e00b67bb
MD5 cd7dd01163c20d877c9dbc7da7e8c684
SHA1 2aad7bba82e9c40d98a711f8c106c5bff5925d11
SHA512 55404dd03b7790ba027f746ae1b996722f77cf88591efc537435f2b79eb3a6072a249695c40970f1f6a54a7a25aec6438dd737f08bbacef7d7ed09a8d8839848
SSDEEP 1536:P09K9+8ifMSDJdvLl7P+JpLMQsAWxt49Y/t8FE8i4A:892+8CnvLZ0MQIxt46/OEV
TLSH
T1C36312116E6D44EB387CB5725938DF0B87E403D81A65D989E3BEB382B36DDC0050BE66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i00mt1eartrb

Path C:\Users\Admin\AppData\Local\Temp\i00mt1eartr\i00mt1eartrb
Size 68KB
SHA256 a1aab166fd63633b2303cfaf42baae152bba0764a976a9c8c3ce6e89818e1695
MD5 87c4e127edfd8fe366b690906b12dcb4
SHA1 c4b2f9ee15c14713d1587d7d9cc1f331caa7cef1
SHA512 5a2351767bb4259a293851ba96520f661a5d3b3d396342f9c0e220852421ebf4dd934dd48165f97724aff9be81f3f8a289edbc4b1d8439bd21df54e2bef9f710
SSDEEP 1536:KSnv4hNsbs/A0MFSRGkCi7iUWseKDgPKGCb:VUNs4YFSYVi7itzPtCb
TLSH
T1C56312B6F88D981427049568223FBDE523D36918E2EBAB3757F0701D9F381467A0B50F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4544-11-0x0000000000F00000-0x0000000000F46000-memory.dmp

Download

memory/4544-12-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/4544-16-0x00000000011D0000-0x0000000001216000-memory.dmp

Download

memory/4544-17-0x00000000011D0000-0x0000000001216000-memory.dmp

Download

memory/4544-18-0x00000000011D0000-0x0000000001216000-memory.dmp

Download

memory/6068-5-0x000001C596020000-0x000001C596042000-memory.dmp

Download

memory/6068-9-0x000001C5AE1A0000-0x000001C5AE1F4000-memory.dmp

Download

memory/6068-10-0x000001C595AE0000-0x000001C595AF2000-memory.dmp

Download