Overview

overview

10

Static

static

5

tmp4kn5nim2.exe

windows10-ltsc_2021-x64

10

tmp4kn5nim2.exe

windows10-2004-x64

10

tmp4kn5nim2.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 12:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmp4kn5nim2.exe
  • Size 1.1MB
  • Sample260602-pmwflsds4v
  • SHA256 928975e4ecab24ccc51bf414c18c63726c02da727803283b70a22f61046911cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
ms84discoveryformbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ms84

Decoy

  • ecurity-ukgaxq.xyz

  • 45ee.top

  • risiddivinayaka.net

  • tizip-skill.xyz

  • ostcanadantet.top

  • 764.xyz

  • oco188rtp.xyz

  • lobalacessory.shop

  • qcq-serve.xyz

  • dameth.top

  • arge-eycert.xyz

  • yzwj-she.xyz

  • bgfrp-plant.xyz

  • emesiartwork.net

  • rcw-hotel.xyz

  • loor-dfqzpi.xyz

  • vidence-zvkkln.xyz

  • oisthuchoyarura.shop

  • 959108ttltxfm842.top

  • apzcc-both.xyz

Signatures

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 4 IoCs
    rat
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Users\Admin\AppData\Local\Temp\tmp4kn5nim2.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp4kn5nim2.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp4kn5nim2.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 780
        3⤵
        • Program crash
        PID:1804
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:988
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4820
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2832 -ip 2832
    1⤵
      PID:744

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/988-14-0x00000000009B0000-0x00000000009BA000-memory.dmp
          Download

          memory/988-16-0x0000000001000000-0x000000000102F000-memory.dmp
          Download

          memory/988-15-0x00000000009B0000-0x00000000009BA000-memory.dmp
          Download

          memory/1420-6-0x0000000000400000-0x000000000042F000-memory.dmp
          Download

          memory/1420-7-0x0000000001660000-0x0000000001675000-memory.dmp
          Download

          memory/1420-3-0x0000000000400000-0x000000000042F000-memory.dmp
          Download

          memory/1420-10-0x0000000000400000-0x000000000042F000-memory.dmp
          Download

          memory/1420-11-0x00000000016B0000-0x00000000016C5000-memory.dmp
          Download

          memory/1420-4-0x0000000001700000-0x0000000001A56000-memory.dmp
          Download

          memory/2832-2-0x00000000043E0000-0x00000000047E0000-memory.dmp
          Download

          memory/3184-13-0x0000000006FE0000-0x000000000712C000-memory.dmp
          Download

          memory/3184-12-0x00000000072F0000-0x0000000007479000-memory.dmp
          Download

          memory/3184-8-0x0000000006FE0000-0x000000000712C000-memory.dmp
          Download

          memory/3184-17-0x00000000072F0000-0x0000000007479000-memory.dmp
          Download

          memory/3184-18-0x00000000049B0000-0x0000000004AAA000-memory.dmp
          Download

          memory/3184-20-0x00000000049B0000-0x0000000004AAA000-memory.dmp
          Download

          memory/3184-22-0x00000000049B0000-0x0000000004AAA000-memory.dmp
          Download