Analysis
- max time kernel
149s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
20/01/2026, 07:27
General
- Target TOI CHALLENGER PARTICULARSpdf.scr.exe
- Size 950KB
- Sample260120-jadr5scy2d
- SHA256 44ece3fd771b241e7adb7b8a46317aa0dce39aa4b815912805de4dc6ff631ae4
Malware Config
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 2 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TOI CHALLENGER PARTICULARSpdf.scr.exe"C:\Users\Admin\AppData\Local\Temp\TOI CHALLENGER PARTICULARSpdf.scr.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TOI CHALLENGER PARTICULARSpdf.scr.exe"C:\Users\Admin\AppData\Local\Temp\TOI CHALLENGER PARTICULARSpdf.scr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4880-0-0x00000000006B0000-0x00000000007A4000-memory.dmp
memory/4880-1-0x00000000057A0000-0x0000000005D46000-memory.dmp
memory/4880-2-0x0000000005290000-0x0000000005322000-memory.dmp
memory/4880-3-0x0000000005260000-0x0000000005270000-memory.dmp
memory/4880-4-0x0000000005250000-0x000000000525A000-memory.dmp
memory/4880-5-0x00000000068F0000-0x0000000006912000-memory.dmp
memory/4880-6-0x00000000068C0000-0x00000000068DE000-memory.dmp
memory/4880-7-0x0000000007210000-0x0000000007226000-memory.dmp
memory/4880-8-0x0000000005260000-0x0000000005270000-memory.dmp
memory/4880-9-0x0000000005260000-0x0000000005270000-memory.dmp
memory/4880-10-0x0000000007240000-0x000000000731C000-memory.dmp
memory/4880-11-0x00000000073C0000-0x000000000745C000-memory.dmp
memory/5016-12-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5016-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5016-15-0x0000000001320000-0x0000000001676000-memory.dmp
memory/5016-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5016-17-0x0000000000400000-0x0000000000446000-memory.dmp