Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
01/05/2026, 03:56
General
- Target DHL AWB 00295126 PDF.exe
- Size 1.4MB
- Sample260501-ehrxhsbx41
- SHA256 92fd962ee5661bc932bc3356de63ed45d14359aa32fb47dc74e4cb10912f1189
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB 00295126 PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB 00295126 PDF.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL AWB 00295126 PDF.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_q0q4lksv.rhi.ps1
memory/1668-36-0x0000000006170000-0x00000000061BC000-memory.dmp
memory/1668-62-0x0000000007810000-0x000000000782A000-memory.dmp
memory/1668-23-0x00000000052C0000-0x00000000058EA000-memory.dmp
memory/1668-68-0x0000000006740000-0x000000000674B000-memory.dmp
memory/1668-67-0x00000000061F0000-0x0000000006215000-memory.dmp
memory/1668-63-0x0000000007800000-0x0000000007808000-memory.dmp
memory/1668-45-0x0000000007130000-0x0000000007164000-memory.dmp
memory/1668-61-0x0000000007710000-0x0000000007725000-memory.dmp
memory/1668-60-0x0000000007700000-0x000000000770E000-memory.dmp
memory/1668-59-0x00000000076D0000-0x00000000076E1000-memory.dmp
memory/1668-58-0x0000000007750000-0x00000000077E6000-memory.dmp
memory/1668-57-0x0000000007540000-0x000000000754A000-memory.dmp
memory/1668-56-0x00000000074C0000-0x00000000074DA000-memory.dmp
memory/1668-55-0x0000000007B10000-0x000000000818A000-memory.dmp
memory/1668-54-0x0000000007390000-0x0000000007434000-memory.dmp
memory/1668-53-0x0000000006760000-0x000000000677E000-memory.dmp
memory/1668-46-0x0000000070A50000-0x0000000070A9C000-memory.dmp
memory/1668-25-0x0000000005290000-0x00000000052B2000-memory.dmp
memory/1668-26-0x0000000005A60000-0x0000000005AC6000-memory.dmp
memory/1668-27-0x0000000005BD0000-0x0000000005C36000-memory.dmp
memory/1668-17-0x00000000028F0000-0x0000000002926000-memory.dmp
memory/1668-34-0x0000000005C40000-0x0000000005F97000-memory.dmp
memory/1668-35-0x0000000006130000-0x000000000614E000-memory.dmp
memory/1668-16-0x00000000028E0000-0x00000000028F0000-memory.dmp
memory/1668-18-0x00000000028E0000-0x00000000028F0000-memory.dmp
memory/1668-66-0x0000000000FB0000-0x0000000000FC9000-memory.dmp
memory/2188-37-0x000001AAD97E0000-0x000001AAD9802000-memory.dmp
memory/2188-70-0x000001AABF910000-0x000001AABF941000-memory.dmp
memory/2188-71-0x000001AABFA60000-0x000001AABFA6C000-memory.dmp
memory/2188-72-0x000001AAD9790000-0x000001AAD97A2000-memory.dmp
memory/2188-44-0x000001AAD9D70000-0x000001AAD9DB6000-memory.dmp
memory/3048-9-0x00000000074B0000-0x0000000007590000-memory.dmp
memory/3048-0-0x00000000008E0000-0x0000000000A42000-memory.dmp
memory/3048-7-0x0000000001400000-0x0000000001422000-memory.dmp
memory/3048-6-0x0000000006170000-0x000000000618E000-memory.dmp
memory/3048-4-0x0000000005640000-0x000000000564A000-memory.dmp
memory/3048-5-0x0000000005880000-0x000000000591C000-memory.dmp
memory/3048-22-0x0000000001400000-0x0000000001422000-memory.dmp
memory/3048-2-0x0000000005580000-0x0000000005612000-memory.dmp
memory/3048-1-0x0000000005A30000-0x0000000005FD6000-memory.dmp
memory/3048-8-0x0000000005560000-0x0000000005570000-memory.dmp
memory/3048-3-0x0000000005560000-0x0000000005570000-memory.dmp
memory/3896-69-0x0000000000D90000-0x0000000000DD6000-memory.dmp
memory/3896-19-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3896-21-0x0000000000D90000-0x0000000000DD6000-memory.dmp
memory/3896-24-0x0000000001140000-0x0000000001496000-memory.dmp
memory/3896-73-0x0000000000D90000-0x0000000000DD6000-memory.dmp
memory/3896-78-0x0000000000D90000-0x0000000000DD6000-memory.dmp
memory/3896-85-0x0000000000D90000-0x0000000000DD6000-memory.dmp