Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
12/02/2026, 13:57
General
- Target Wonjin_P_Shipping_Documents_Feb2026.pdf.exe
- Size 1.1MB
- Sample260212-q9csfsds7e
- SHA256 3c97c9c3fd33f0deafc90dac2192ca8a44a44732368e02fdafbf35da539091aa
Malware Config
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wonjin_P_Shipping_Documents_Feb2026.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Wonjin_P_Shipping_Documents_Feb2026.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wonjin_P_Shipping_Documents_Feb2026.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Wonjin_P_Shipping_Documents_Feb2026.pdf.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4104 -ip 41041⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1348-0-0x0000000000930000-0x0000000000A44000-memory.dmp
memory/1348-1-0x0000000005A80000-0x0000000006026000-memory.dmp
memory/1348-2-0x0000000005570000-0x0000000005602000-memory.dmp
memory/1348-3-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/1348-4-0x0000000005510000-0x000000000551A000-memory.dmp
memory/1348-5-0x0000000008B30000-0x0000000008C22000-memory.dmp
memory/1348-6-0x0000000006640000-0x0000000006652000-memory.dmp
memory/1348-7-0x0000000006AA0000-0x0000000006B7A000-memory.dmp
memory/1348-8-0x0000000006C60000-0x0000000006CFC000-memory.dmp
memory/4104-9-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4104-10-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4104-12-0x00000000019B0000-0x0000000001D06000-memory.dmp
memory/4104-13-0x0000000000400000-0x0000000000446000-memory.dmp