Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/02/2026, 15:59
General
- Target f1a8e538157bfb627e37f4da7ae8336f75d4e0a2aecc38eda2a141fa04547659.exe
- Size 1.1MB
- Sample260205-te8hescw5e
- SHA256 f1a8e538157bfb627e37f4da7ae8336f75d4e0a2aecc38eda2a141fa04547659
Malware Config
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 2 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1a8e538157bfb627e37f4da7ae8336f75d4e0a2aecc38eda2a141fa04547659.exe"C:\Users\Admin\AppData\Local\Temp\f1a8e538157bfb627e37f4da7ae8336f75d4e0a2aecc38eda2a141fa04547659.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1056-504-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1056-505-0x0000000001A70000-0x0000000001DC6000-memory.dmp
memory/1056-506-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1056-507-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4408-0-0x00000000002E0000-0x0000000000406000-memory.dmp
memory/4408-1-0x0000000005560000-0x0000000005B06000-memory.dmp
memory/4408-2-0x0000000004EB0000-0x0000000004F42000-memory.dmp
memory/4408-3-0x0000000005050000-0x00000000050EC000-memory.dmp
memory/4408-4-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/4408-5-0x0000000004EA0000-0x0000000004EAA000-memory.dmp
memory/4408-6-0x0000000006D70000-0x0000000006DC0000-memory.dmp
memory/4408-10-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-8-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-34-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-98-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-94-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-92-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-88-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-86-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-82-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-80-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-78-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-72-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-70-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-68-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-66-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-58-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-56-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-54-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-52-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-106-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-130-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-126-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-122-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-120-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-495-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/4408-118-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-496-0x0000000006F50000-0x0000000006F66000-memory.dmp
memory/4408-116-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-114-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-497-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/4408-110-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-108-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-104-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-102-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-100-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-132-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-128-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-125-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-112-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-50-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-49-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-44-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-42-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-40-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-38-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-32-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-30-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-28-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-26-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-24-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-22-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-20-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-18-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-96-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-16-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-90-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-14-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-84-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-76-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-75-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-12-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-64-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-62-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-60-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-46-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-36-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-7-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/4408-498-0x0000000007020000-0x0000000007036000-memory.dmp
memory/4408-499-0x0000000009DD0000-0x0000000009DD6000-memory.dmp
memory/4408-500-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/4408-501-0x00000000052D0000-0x00000000052E0000-memory.dmp