Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260126-en - resource tags
- submitted
29/01/2026, 06:03
General
- Target Shipping Documents.exe
- Size 1.2MB
- Sample260129-gr9vsshs7b
- SHA256 e5c7bc7ad2dbd1b81fd1a52ceaa6dc9a2e9e856656e0d491efc9ab7f40a8e697
Score
10/10
Malware Config
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
autE465.tmp
memory/4556-13-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4556-12-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4556-14-0x0000000001700000-0x0000000001A56000-memory.dmp
memory/4556-15-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4556-16-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4648-11-0x0000000001AA0000-0x0000000001AA4000-memory.dmp