Analysis
- max time kernel
149s - max time network
145s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
23/05/2026, 01:03
General
- Target tmpxvlr6hod.exe
- Size 1.1MB
- Sample260523-beftasct31
- SHA256 e0758597228ea6a49eeb52477945524d7d660bed6c5f9259ed4a73ebfbae704e
Malware Config
Extracted
-
formbook
-
4.1
-
ou07
-
lynqzawhp.info
-
33vy2hv2v7hoy4q.sbs
-
aiujx3.sbs
-
36fv88.com
-
y9fbyfoi.asia
-
jsspaint.com
-
amjbchicay.space
-
zenoptions.app
-
crownceylontours.com
-
thesecondseat.co
-
57clubvulkan.com
-
sufficient.pl
-
glscontact-suivicolis.com
-
clubmetropolitan.ch
-
rapidventcleaning.com
-
lspaihd.website
-
clubpk303.com
-
kalosclothings.com
-
xn----8sbb0chcjpfe.online
-
earningapps.in
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpxvlr6hod.exe"C:\Users\Admin\AppData\Local\Temp\tmpxvlr6hod.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\tmpxvlr6hod.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1864-4-0x00000000006A0000-0x00000000006A4000-memory.dmp
memory/3408-74-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-36-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-124-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-125-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-15-0x0000000002FF0000-0x00000000030E0000-memory.dmp
memory/3408-17-0x0000000002FF0000-0x00000000030E0000-memory.dmp
memory/3408-19-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-20-0x0000000003470000-0x0000000003480000-memory.dmp
memory/3408-18-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-21-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-22-0x0000000002FF0000-0x00000000030E0000-memory.dmp
memory/3408-23-0x00007FFD00342000-0x00007FFD00343000-memory.dmp
memory/3408-24-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-25-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-28-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-27-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-26-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-30-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-29-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-31-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-73-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-33-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-40-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-39-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-41-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-45-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-44-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-43-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-42-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-38-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-37-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-10-0x0000000009F50000-0x000000000A05B000-memory.dmp
memory/3408-35-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-34-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-47-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-46-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-49-0x0000000003470000-0x0000000003480000-memory.dmp
memory/3408-48-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-55-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-56-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-58-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-57-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-60-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-59-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-75-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-61-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-64-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-63-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-65-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-66-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-67-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-68-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-62-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-14-0x0000000009F50000-0x000000000A05B000-memory.dmp
memory/3408-32-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-72-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-71-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-70-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-69-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-77-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-76-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-79-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-78-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-80-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-81-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-83-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-82-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-88-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-87-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-89-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-90-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-92-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-91-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-97-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-96-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-99-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-98-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-95-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-94-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-93-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-100-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-102-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-103-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-106-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-105-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-104-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-101-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-108-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-107-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-109-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-110-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-111-0x00007FFD002A0000-0x00007FFD003A7000-memory.dmp
memory/3408-116-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-117-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-118-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-119-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-120-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-121-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-122-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-123-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3408-126-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/3988-11-0x00000000002A0000-0x00000000002C7000-memory.dmp
memory/3988-12-0x00000000002A0000-0x00000000002C7000-memory.dmp
memory/3988-13-0x0000000000760000-0x000000000078F000-memory.dmp
memory/4140-5-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4140-6-0x0000000001C00000-0x0000000001F4C000-memory.dmp
memory/4140-8-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4140-9-0x00000000019B0000-0x00000000019C5000-memory.dmp