formbook | 819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe
Size 2.6MB
Sample261109-kt2trawv2j
SHA256 819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d
MD5 0f575e7cd23e5fd894c24610ffb2db5f
SHA1 25cd1d404424d40b9f83c3ff5431759fec18bed0
SHA512 c6b5cfa0a08d01011a67978362aa2387b025a3eca80fb8e296e099ba49113ef825db08a6c1f1de583ae51af86fbd67ba5e3774dd1927fce6f304e0cc29e52571
SSDEEP 49152:qidDZK+GOp0PSAwGIQ8JnjpzHVDLZHGABhtm6q:qiq7Sj3j/HFHw6q
TLSH
T120C5AD36B1838A71E5B6033049A9F3B096AEBE054731AA97F3D4F30D1C751969B2B353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery formbook persistence privilege_escalation rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2128-14-0x0000000000860000-0x00000000008A7000-memory.dmp	family_formbook
behavioral2/memory/2128-16-0x0000000000860000-0x00000000008A7000-memory.dmp	family_formbook
behavioral2/memory/2128-31-0x0000000000860000-0x00000000008A7000-memory.dmp	family_formbook
behavioral2/memory/2152-35-0x0000000000470000-0x00000000004B4000-memory.dmp	family_formbook

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\nvfsflt64.sys	Nero Update Service.exe
File created	C:\Windows\System32\drivers\nvfsflt64.sys	819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe
File opened for modification	C:\Windows\System32\drivers\nvfsflt64.sys	819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nero Update Service\ImagePath = "\"C:\\ProgramData\\Nero\\Update\\Nero Update Service.exe\""	819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe

Executes dropped EXE 5 IoCs

pid	Process
5152	nvfsflt64.sys
2128	tmpicwjxj.tmp.exe
6064	Nero Update Service.exe
2856	Nero Update Service.exe
2924	tmpcp1xpd.tmp.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rasdial.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 2616	2128	tmpicwjxj.tmp.exe
PID 2128 set thread context of 2152	2128	tmpicwjxj.tmp.exe	95
PID 2152 set thread context of 2872	2152	rasdial.exe	79
PID 2152 set thread context of 1348	2152	rasdial.exe	100

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpicwjxj.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nero Update Service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nero Update Service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rasdial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpcp1xpd.tmp.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4154726816-2055034831-2297277433-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	rasdial.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2128	tmpicwjxj.tmp.exe
2128	tmpicwjxj.tmp.exe
2128	tmpicwjxj.tmp.exe
2128	tmpicwjxj.tmp.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2924	tmpcp1xpd.tmp.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	explorer.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: MapViewOfSection 1 TTPs 7 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2128	tmpicwjxj.tmp.exe
2616	Process not Found
2616	Process not Found
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe
2152	rasdial.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 3824	752	DllHost.exe	89
PID 3824 wrote to memory of 2128	3824	819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe	92
PID 2616 wrote to memory of 2152	2616	Process not Found	95
PID 2616 wrote to memory of 6064	2616	Process not Found	94
PID 752 wrote to memory of 2856	752	DllHost.exe	96
PID 2856 wrote to memory of 2924	2856	Nero Update Service.exe	97
PID 2152 wrote to memory of 1348	2152	rasdial.exe	100

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rasdial.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2872
- C:\Users\Admin\AppData\Local\Temp\819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe
  "C:\Users\Admin\AppData\Local\Temp\819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5560

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe
  "C:\Users\Admin\AppData\Local\Temp\819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe" --hs Suacc4d4ca059c8a
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Users\Admin\AppData\Local\Temp\tmpicwjxj.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpicwjxj.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2128
- C:\ProgramData\Nero\Update\Nero Update Service.exe
  "C:\ProgramData\Nero\Update\Nero Update Service.exe" --hs Suacf4e33bfe6157
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\tmpcp1xpd.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpcp1xpd.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2924

C:\Windows\System32\drivers\nvfsflt64.sys
C:\Windows\System32\drivers\nvfsflt64.sys
1⤵
- Executes dropped EXE
PID:5152

C:\ProgramData\Nero\Update\Nero Update Service.exe
"C:\ProgramData\Nero\Update\Nero Update Service.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6064

C:\Windows\SysWOW64\rasdial.exe
"C:\Windows\SysWOW64\rasdial.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:2152
- C:\Program Files\Mozilla Firefox\Firefox.exe
  "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2⤵
  PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpicwjxj.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpicwjxj.tmp.exe
Size 280KB
SHA256 920cd0c5e50622c32ba6a97b643223f8312bd62858cf60397ac8973f0f8ee978
MD5 d694a28167a61d2a388ce99ab863aa52
SHA1 0d8b65355fc93d8e43d542c3bd572d2524fce809
SHA512 bf77591791d7f90f215c904378f809ef7e13ac32971ccfca46848543728c9d133a0a99d78554fa643c436c0cda515f8153c330c8fb38611b08facaaf408305e4
SSDEEP 6144:or5YZj/Ki25uZcwfWBINpzDqPCtHTtupd+k2b943ayl:oYR72u+qfqP8kn+D4Ky
TLSH
T10E54230283405247D9DAC27515DBC3834E5A62B1F855A16BF09A9C30AD810FCEEEFE6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvfsflt64.sys

Path C:\Windows\System32\drivers\nvfsflt64.sys
Size 41KB
SHA256 12bef446e2d58d415c8ab073f5c6a8100be7b8ee49729e88dcc3b64ec7a1906b
MD5 b334c1dd1d0979ed7ea78a05de8044a7
SHA1 03942bcd91107baf27b0bcde42be8ce7667d4b7e
SHA512 304b69e344ec7dd9212b090166089cdd7ad8df8c60f37d0a4257c862e42b32250666117b3a01f97cd54db4b423a2fa312b9d3a519c7f6774d3f104eef14f9404
SSDEEP 768:x4q1bOah4cTWVkuaAJ+h24/gvg8h69zKQYiSvkAMxkEuq+:XOag/JVhmz97Svixiq+
TLSH
T1C0137CD546AC18C2EAAB8E7162E885A7BD707B83175186DF0264C1740F63FC0AB3D769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1348-49-0x00000182D6F30000-0x00000182D702C000-memory.dmp

Download

memory/2128-31-0x0000000000860000-0x00000000008A7000-memory.dmp

Download

memory/2128-14-0x0000000000860000-0x00000000008A7000-memory.dmp

Download

memory/2128-15-0x0000000000DB0000-0x0000000001124000-memory.dmp

Download

memory/2128-16-0x0000000000860000-0x00000000008A7000-memory.dmp

Download

memory/2152-20-0x0000000000470000-0x00000000004B4000-memory.dmp

Download

memory/2152-35-0x0000000000470000-0x00000000004B4000-memory.dmp

Download

memory/2616-18-0x0000000000180000-0x0000000001D7E000-memory.dmp

Download

memory/2616-32-0x0000000000180000-0x0000000001D7E000-memory.dmp

Download

memory/2856-30-0x0000000001470000-0x0000000001480000-memory.dmp

Download

memory/2872-42-0x0000000005B00000-0x0000000005BFE000-memory.dmp

Download

memory/3824-5-0x0000000006880000-0x0000000006890000-memory.dmp

Download

memory/5560-0-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Download

memory/6064-24-0x00000000014C0000-0x00000000014D0000-memory.dmp

Download