Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 06:48
General
- Target Para transferi makbuzu 2131RI50089500.exe
- Size 1.0MB
- Sample260602-hkt2fafv7s
- SHA256 4e635e08da9caa7a6c08b4d401acbd9141bbde92d9f5cb5aafa03d6706cb228b
Malware Config
Extracted
-
formbook
-
4.1
-
ge47
-
venloria.us
-
bythebellboxing.com
-
dakarcocktail.com
-
wrqgd.xyz
-
furbabyfortune.shop
-
thousandoaksbsalandscaping.com
-
fixitfuego.online
-
contexception.com
-
bosslifesa.com
-
happybusiness.fr
-
pokerdom-kasinos-site.ru
-
getscalespilot.co
-
eqtreporting.com
-
jefyd.top
-
taskforcebot.com
-
spectrumcomercial.com
-
43dqb.top
-
ncooleyrealty.com
-
usemention.ai
-
droppingjulzz.com
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 50 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\Para transferi makbuzu 2131RI50089500.exe"C:\Users\Admin\AppData\Local\Temp\Para transferi makbuzu 2131RI50089500.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Para transferi makbuzu 2131RI50089500.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Para transferi makbuzu 2131RI50089500.exe"C:\Users\Admin\AppData\Local\Temp\Para transferi makbuzu 2131RI50089500.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_e0xovx41.t2r.ps1
memory/1964-8-0x0000000007EF0000-0x0000000007FB8000-memory.dmp
memory/1964-0-0x0000000000110000-0x0000000000216000-memory.dmp
memory/1964-3-0x0000000004E40000-0x0000000004E50000-memory.dmp
memory/1964-4-0x0000000004D70000-0x0000000004D7A000-memory.dmp
memory/1964-5-0x0000000004FE0000-0x000000000507C000-memory.dmp
memory/1964-6-0x0000000005D90000-0x0000000005DA8000-memory.dmp
memory/1964-7-0x0000000004E40000-0x0000000004E50000-memory.dmp
memory/1964-1-0x0000000005350000-0x00000000058F6000-memory.dmp
memory/1964-2-0x0000000004CC0000-0x0000000004D52000-memory.dmp
memory/3244-60-0x0000000004F40000-0x0000000005095000-memory.dmp
memory/3244-61-0x0000000007870000-0x0000000007A11000-memory.dmp
memory/3244-22-0x0000000004F40000-0x0000000005095000-memory.dmp
memory/3468-58-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3468-59-0x0000000001350000-0x0000000001364000-memory.dmp
memory/3468-18-0x0000000001300000-0x0000000001314000-memory.dmp
memory/3468-17-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3468-16-0x00000000013A0000-0x00000000016F6000-memory.dmp
memory/3468-9-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4000-29-0x00000000054D0000-0x0000000005827000-memory.dmp
memory/4000-45-0x0000000006CF0000-0x0000000006D0A000-memory.dmp
memory/4000-20-0x0000000005200000-0x0000000005266000-memory.dmp
memory/4000-21-0x0000000005460000-0x00000000054C6000-memory.dmp
memory/4000-30-0x00000000059C0000-0x00000000059DE000-memory.dmp
memory/4000-31-0x00000000059E0000-0x0000000005A2C000-memory.dmp
memory/4000-32-0x000000007F490000-0x000000007F4A0000-memory.dmp
memory/4000-34-0x00000000715F0000-0x000000007163C000-memory.dmp
memory/4000-42-0x00000000021A0000-0x00000000021B0000-memory.dmp
memory/4000-41-0x0000000005FC0000-0x0000000005FDE000-memory.dmp
memory/4000-33-0x0000000005F60000-0x0000000005F94000-memory.dmp
memory/4000-43-0x0000000006B90000-0x0000000006C34000-memory.dmp
memory/4000-44-0x0000000007330000-0x00000000079AA000-memory.dmp
memory/4000-19-0x0000000004A00000-0x0000000004A22000-memory.dmp
memory/4000-46-0x0000000006D70000-0x0000000006D7A000-memory.dmp
memory/4000-47-0x0000000006F80000-0x0000000007016000-memory.dmp
memory/4000-48-0x0000000006F00000-0x0000000006F11000-memory.dmp
memory/4000-49-0x00000000021A0000-0x00000000021B0000-memory.dmp
memory/4000-50-0x0000000006F30000-0x0000000006F3E000-memory.dmp
memory/4000-51-0x0000000006F40000-0x0000000006F55000-memory.dmp
memory/4000-52-0x0000000007040000-0x000000000705A000-memory.dmp
memory/4000-53-0x0000000007030000-0x0000000007038000-memory.dmp
memory/4000-54-0x00000000021A0000-0x00000000021B0000-memory.dmp
memory/4000-13-0x00000000021A0000-0x00000000021B0000-memory.dmp
memory/4000-14-0x0000000004BD0000-0x00000000051FA000-memory.dmp
memory/4000-12-0x00000000021A0000-0x00000000021B0000-memory.dmp
memory/4000-11-0x00000000021D0000-0x0000000002206000-memory.dmp