formbook | 11e9209e824c97be6fd84e97a7c7582a30788af83635288b595bce1cfdad166d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11e9209e824c97be6fd84e97a7c7582a30788af83635288b595bce1cfdad166d.exe
Size 277KB
Sample260826-ketjtsstdv
SHA256 11e9209e824c97be6fd84e97a7c7582a30788af83635288b595bce1cfdad166d
MD5 8554ba0578841af9cc8754f2bf97df77
SHA1 976a84c4a99446cd54707c14caa1668df9893600
SHA512 a6cabe6b801272dd824ca325b6a7a8dd22e9643e1642b2dd79b385bfbc77211cb9c90de59fe9b1ac92bf2740bdcf3361ea867dc0f998e14427fe7c4ef65dc710
SSDEEP 6144:Uopfsbk26orWWk0lXnM1iKlzalUiBaaAlub69Qi9UVcWsoKxldnoXhDK:Uop0bkmlXMUKlOiFlmZiSHSxldnp
TLSH
T1D754234CC7124841FCA479BA4DC9E5CA1D7A63372DBB698177DA8C7433A22C52D2BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/4796-2-0x0000000000970000-0x00000000009B6000-memory.dmp	family_formbook

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5592	4796	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11e9209e824c97be6fd84e97a7c7582a30788af83635288b595bce1cfdad166d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4796	11e9209e824c97be6fd84e97a7c7582a30788af83635288b595bce1cfdad166d.exe

C:\Users\Admin\AppData\Local\Temp\11e9209e824c97be6fd84e97a7c7582a30788af83635288b595bce1cfdad166d.exe
"C:\Users\Admin\AppData\Local\Temp\11e9209e824c97be6fd84e97a7c7582a30788af83635288b595bce1cfdad166d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 220
  2⤵
  - Program crash
  PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4796 -ip 4796
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-0-0x0000000000970000-0x00000000009B6000-memory.dmp

Download

memory/4796-1-0x0000000001340000-0x000000000168A000-memory.dmp

Download

memory/4796-2-0x0000000000970000-0x00000000009B6000-memory.dmp

Download