Analysis
- max time kernel
101s - max time network
109s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
10/09/2025, 12:52
General
- Target Payment_advic_0097766886.pif.exe
- Size 830KB
- Sample250910-p36arayqs9
- SHA256 e1f4bf968e975bdb45e48107ef68200d53e96ee2598b44e1f424ab7e298b4e52
Malware Config
Extracted
-
formbook
-
4.1
-
ol06
-
btt.app
-
7648419.vip
-
euenviiodiigiital.shop
-
entry.sbs
-
eroysane.xyz
-
k2y7bcw.xyz
-
elcuksozluk.xyz
-
00hu05.shop
-
ork-law-9s10s5.live
-
niquetouchsweets.shop
-
orklift-jobs-78023.bond
-
c3974.top
-
ormiimpal.pro
-
learnotion.xyz
-
pcj.net
-
arinsoft.net
-
z23.top
-
vmdia7.xyz
-
iyabet.xyz
-
ujitegemea.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment_advic_0097766886.pif.exe"C:\Users\Admin\AppData\Local\Temp\Payment_advic_0097766886.pif.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment_advic_0097766886.pif.exe"C:\Users\Admin\AppData\Local\Temp\Payment_advic_0097766886.pif.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3192-0-0x00000000009E0000-0x0000000000AB4000-memory.dmp
memory/3192-1-0x0000000005AC0000-0x0000000006066000-memory.dmp
memory/3192-2-0x00000000055B0000-0x0000000005642000-memory.dmp
memory/3192-3-0x0000000005750000-0x0000000005760000-memory.dmp
memory/3192-4-0x0000000005560000-0x000000000556A000-memory.dmp
memory/3192-5-0x0000000005A70000-0x0000000005A8A000-memory.dmp
memory/3192-6-0x0000000005750000-0x0000000005760000-memory.dmp
memory/3192-7-0x00000000084B0000-0x0000000008528000-memory.dmp
memory/3192-8-0x000000000ACB0000-0x000000000AD4C000-memory.dmp
memory/3892-9-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3892-11-0x00000000011E0000-0x0000000001536000-memory.dmp