formbook | 80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe
Size 979KB
Sample260910-mxevhavxhz
SHA256 80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d
MD5 c4e1245d6d827d00323c87fad343661f
SHA1 0611893b2a1fbda50526389056adc29c274eb620
SHA512 556a3dc4d7105fcb4017e32f16db9bf35d77f3ee9ad22ddf7603c421f3ad8c5bd4d6da4601f511af95106504e8ad80f00b47758c904316269f141c683d8175d9
SSDEEP 24576:zD49lDbVescvD0GbS8aVjecgfjx3/HKEZptScmuwGxofa9inc:P49CscvD/O8a50jJ/HfZpHmuwGy6inc
TLSH
T10925235C5A48CA2BD46A0A755FB4F3B1023D5DEDBD02EE4A4FC2ADDF353A6902C15B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/2612-12-0x00000000014B0000-0x00000000014F6000-memory.dmp	family_formbook
behavioral2/memory/2612-32-0x00000000014B0000-0x00000000014F6000-memory.dmp	family_formbook
behavioral2/memory/2612-38-0x00000000014B0000-0x00000000014F6000-memory.dmp	family_formbook
behavioral2/memory/2612-40-0x00000000014B0000-0x00000000014F6000-memory.dmp	family_formbook
behavioral2/memory/1584-41-0x0000000000110000-0x0000000000153000-memory.dmp	family_formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5812	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3712	ja.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	odbcconf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ja = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$gobr0p=8679;$yu5vln=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$1nyjtz=[System.Environment]::TickCount;$reg104=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXGphLmV4ZQ==')));$zmmvsb=$env:COMPUTERNAME;& $yu5vln -FilePath $reg104\""	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 604 set thread context of 2612	604	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe	89
PID 2612 set thread context of 5416	2612	RegSvcs.exe
PID 2612 set thread context of 1584	2612	RegSvcs.exe	94
PID 1584 set thread context of 2628	1584	odbcconf.exe	81
PID 3712 set thread context of 5880	3712	ja.exe	96
PID 1584 set thread context of 2804	1584	odbcconf.exe	97

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odbcconf.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-552508041-2681165170-3229858294-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	odbcconf.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
604	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe
604	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe
2612	RegSvcs.exe
2612	RegSvcs.exe
2612	RegSvcs.exe
5812	powershell.exe
5812	powershell.exe
2612	RegSvcs.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
3712	ja.exe
3712	ja.exe
3712	ja.exe
3712	ja.exe
5880	RegSvcs.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	explorer.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2612	RegSvcs.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe
1584	odbcconf.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	604	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe
Token: SeDebugPrivilege	5812	powershell.exe
Token: SeDebugPrivilege	3712	ja.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe
Token: SeShutdownPrivilege	2628	explorer.exe
Token: SeCreatePagefilePrivilege	2628	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 2612	604	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe	89
PID 604 wrote to memory of 2612	604	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe	89
PID 604 wrote to memory of 2612	604	80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe	89
PID 5812 wrote to memory of 3712	5812	powershell.exe	92
PID 3712 wrote to memory of 3428	3712	ja.exe	95
PID 3712 wrote to memory of 5880	3712	ja.exe	96
PID 3712 wrote to memory of 5880	3712	ja.exe	96
PID 3712 wrote to memory of 5880	3712	ja.exe	96
PID 1584 wrote to memory of 2804	1584	odbcconf.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	odbcconf.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2628
- C:\Users\Admin\AppData\Local\Temp\80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe
  "C:\Users\Admin\AppData\Local\Temp\80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2612

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$gobr0p=8679;$yu5vln=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$1nyjtz=[System.Environment]::TickCount;$reg104=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXGphLmV4ZQ==')));$zmmvsb=$env:COMPUTERNAME;& $yu5vln -FilePath $reg104"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Users\Admin\AppData\Roaming\ja.exe
  "C:\Users\Admin\AppData\Roaming\ja.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5880

C:\Windows\SysWOW64\odbcconf.exe
"C:\Windows\SysWOW64\odbcconf.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:1584
- C:\Program Files\Mozilla Firefox\Firefox.exe
  "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2⤵
  PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ja.exe

Path C:\Users\Admin\AppData\Roaming\ja.exe
Size 979KB
SHA256 80e1fc8f42b0a8ac2de2235999664af6c0cf77d55b419cb10722f79372d2b99d
MD5 c4e1245d6d827d00323c87fad343661f
SHA1 0611893b2a1fbda50526389056adc29c274eb620
SHA512 556a3dc4d7105fcb4017e32f16db9bf35d77f3ee9ad22ddf7603c421f3ad8c5bd4d6da4601f511af95106504e8ad80f00b47758c904316269f141c683d8175d9
SSDEEP 24576:zD49lDbVescvD0GbS8aVjecgfjx3/HKEZptScmuwGxofa9inc:P49CscvD/O8a50jJ/HfZpHmuwGy6inc
TLSH
T10925235C5A48CA2BD46A0A755FB4F3B1023D5DEDBD02EE4A4FC2ADDF353A6902C15B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/604-6-0x0000000005950000-0x000000000595E000-memory.dmp

Download

memory/604-8-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/604-3-0x00000000057A0000-0x0000000005832000-memory.dmp

Download

memory/604-4-0x0000000005840000-0x000000000584A000-memory.dmp

Download

memory/604-5-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/604-0-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/604-7-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/604-2-0x0000000005E80000-0x000000000643A000-memory.dmp

Download

memory/604-9-0x00000000071E0000-0x000000000727C000-memory.dmp

Download

memory/604-10-0x0000000005D80000-0x0000000005E68000-memory.dmp

Download

memory/604-1-0x0000000000B90000-0x0000000000C8A000-memory.dmp

Download

memory/604-13-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/1584-39-0x0000000000110000-0x0000000000153000-memory.dmp

Download

memory/1584-41-0x0000000000110000-0x0000000000153000-memory.dmp

Download

memory/2612-32-0x00000000014B0000-0x00000000014F6000-memory.dmp

Download

memory/2612-36-0x0000000005980000-0x00000000059A4000-memory.dmp

Download

memory/2612-11-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2612-40-0x00000000014B0000-0x00000000014F6000-memory.dmp

Download

memory/2612-12-0x00000000014B0000-0x00000000014F6000-memory.dmp

Download

memory/2612-38-0x00000000014B0000-0x00000000014F6000-memory.dmp

Download

memory/2612-14-0x0000000001AB0000-0x0000000001E24000-memory.dmp

Download

memory/2612-35-0x00000000014B0000-0x00000000014F6000-memory.dmp

Download

memory/2628-42-0x0000000004DA0000-0x0000000004E9D000-memory.dmp

Download

memory/2804-50-0x000001E45B690000-0x000001E45B78C000-memory.dmp

Download

memory/5812-24-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-37-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-29-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-30-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-31-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-15-0x00007FF83E9BF000-0x00007FF83E9C0000-memory.dmp

Download

memory/5812-27-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-28-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-26-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-25-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-16-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-22-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-23-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-20-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5812-21-0x0000019322BA0000-0x0000019322BC2000-memory.dmp

Download

memory/5812-17-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download