Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
24/10/2025, 13:12
General
- Target TT REQUISITION FOR 84400.00GARDENIA WEARSINVOICE NO-4002025.bat.exe
- Size 742KB
- Sample251024-qfmesszqbm
- SHA256 e80ff6956ffb3e3189596fe42c13b03efb70c023bb9db2f83db9d91ec04a157c
Malware Config
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT REQUISITION FOR 84400.00GARDENIA WEARSINVOICE NO-4002025.bat.exe"C:\Users\Admin\AppData\Local\Temp\TT REQUISITION FOR 84400.00GARDENIA WEARSINVOICE NO-4002025.bat.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TT REQUISITION FOR 84400.00GARDENIA WEARSINVOICE NO-4002025.bat.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3hpgvoe5.4vs.ps1
memory/3096-39-0x00000000073A0000-0x0000000007A1A000-memory.dmp
memory/3096-26-0x0000000005F50000-0x0000000005F9C000-memory.dmp
memory/3096-47-0x00000000070A0000-0x00000000070A8000-memory.dmp
memory/3096-46-0x00000000070B0000-0x00000000070CA000-memory.dmp
memory/3096-45-0x0000000006FB0000-0x0000000006FC5000-memory.dmp
memory/3096-44-0x0000000006FA0000-0x0000000006FAE000-memory.dmp
memory/3096-43-0x0000000006F70000-0x0000000006F81000-memory.dmp
memory/3096-42-0x0000000006FF0000-0x0000000007086000-memory.dmp
memory/3096-41-0x0000000006DE0000-0x0000000006DEA000-memory.dmp
memory/3096-27-0x000000007F3C0000-0x000000007F3D0000-memory.dmp
memory/3096-12-0x0000000000DA0000-0x0000000000DD6000-memory.dmp
memory/3096-13-0x0000000000EF0000-0x0000000000F00000-memory.dmp
memory/3096-14-0x0000000004CF0000-0x000000000531A000-memory.dmp
memory/3096-40-0x0000000006D60000-0x0000000006D7A000-memory.dmp
memory/3096-20-0x00000000053A0000-0x00000000053C2000-memory.dmp
memory/3096-23-0x0000000005530000-0x0000000005596000-memory.dmp
memory/3096-22-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/3096-24-0x0000000005690000-0x00000000059E7000-memory.dmp
memory/3096-38-0x0000000006C10000-0x0000000006CB4000-memory.dmp
memory/3096-25-0x0000000005A00000-0x0000000005A1E000-memory.dmp
memory/3096-11-0x0000000000EF0000-0x0000000000F00000-memory.dmp
memory/3096-29-0x0000000071410000-0x000000007145C000-memory.dmp
memory/3096-36-0x0000000000EF0000-0x0000000000F00000-memory.dmp
memory/3096-28-0x0000000006BD0000-0x0000000006C04000-memory.dmp
memory/3096-37-0x0000000005FF0000-0x000000000600E000-memory.dmp
memory/4280-3-0x0000000005110000-0x0000000005120000-memory.dmp
memory/4280-0-0x0000000000430000-0x00000000004EE000-memory.dmp
memory/4280-1-0x00000000055F0000-0x0000000005B96000-memory.dmp
memory/4280-7-0x0000000005110000-0x0000000005120000-memory.dmp
memory/4280-8-0x00000000054B0000-0x0000000005542000-memory.dmp
memory/4280-5-0x00000000052B0000-0x000000000534C000-memory.dmp
memory/4280-6-0x0000000005480000-0x0000000005496000-memory.dmp
memory/4280-2-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/4280-4-0x0000000005020000-0x000000000502A000-memory.dmp
memory/5264-9-0x0000000000400000-0x0000000000448000-memory.dmp
memory/5264-50-0x0000000000400000-0x0000000000448000-memory.dmp
memory/5264-51-0x00000000018F0000-0x0000000001C46000-memory.dmp
memory/5264-52-0x0000000000400000-0x0000000000448000-memory.dmp