Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
08/06/2026, 09:48
General
- Target 35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe
- Size 890KB
- Sample260608-ls2m2acv4v
- SHA256 35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef
Malware Config
Extracted
-
formbook
-
4.1
-
be04
-
contentgirl.pl
-
habad9sud.fr
-
moviezlib.online
-
knowledgeunlocker.com
-
hidrosistemassplash.com
-
sinatra-integration-ninja.xyz
-
story-present-multivariate.xyz
-
gqita0.makeup
-
annahalliwellg.com
-
uexly.com
-
rqhqlzus.lol
-
chess-kaiyuanchess.com
-
project-brand-qlik.xyz
-
kaleighdent.com
-
grindgears.com
-
pinealai.tech
-
x7317xx.cc
-
rakmirror.com
-
lieyafan.com
-
integralpropertycleaning.com
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe"C:\Users\Admin\AppData\Local\Temp\35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe"C:\Users\Admin\AppData\Local\Temp\35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe"C:\Users\Admin\AppData\Local\Temp\35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\IjEpNfKOj.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\viyqll33nly.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\IjEpNfKOj.exe"C:\Users\Admin\AppData\Roaming\IjEpNfKOj.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IjEpNfKOj.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\IjEpNfKOj.exe"C:\Users\Admin\AppData\Roaming\IjEpNfKOj.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1nq5b3ks.axd.ps1
viyqll33nly.ps1
IjEpNfKOj.exe
memory/672-87-0x0000000007AF0000-0x0000000007B94000-memory.dmp
memory/672-89-0x0000000007DF0000-0x0000000007E05000-memory.dmp
memory/672-79-0x0000000006D90000-0x0000000006DDC000-memory.dmp
memory/672-80-0x0000000070AA0000-0x0000000070AEC000-memory.dmp
memory/672-88-0x0000000007DA0000-0x0000000007DB1000-memory.dmp
memory/956-38-0x0000017D77B70000-0x0000017D77B92000-memory.dmp
memory/2460-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2460-19-0x00000000012E0000-0x0000000001636000-memory.dmp
memory/2728-6-0x0000000005B60000-0x0000000005B72000-memory.dmp
memory/2728-0-0x00000000009C0000-0x0000000000AA4000-memory.dmp
memory/2728-8-0x0000000008CA0000-0x0000000008D68000-memory.dmp
memory/2728-7-0x00000000057A0000-0x00000000057B0000-memory.dmp
memory/2728-5-0x0000000005850000-0x00000000058EC000-memory.dmp
memory/2728-4-0x0000000005550000-0x000000000555A000-memory.dmp
memory/2728-3-0x00000000057A0000-0x00000000057B0000-memory.dmp
memory/2728-2-0x00000000055C0000-0x0000000005652000-memory.dmp
memory/2728-1-0x0000000005B70000-0x0000000006116000-memory.dmp
memory/3212-94-0x0000000005F80000-0x0000000006103000-memory.dmp
memory/4444-91-0x00000000001F0000-0x0000000000215000-memory.dmp
memory/4444-92-0x0000000000730000-0x000000000075F000-memory.dmp
memory/4464-17-0x0000000005660000-0x0000000005670000-memory.dmp
memory/4464-61-0x0000000008040000-0x000000000805A000-memory.dmp
memory/4464-52-0x0000000007B70000-0x0000000007B8E000-memory.dmp
memory/4464-53-0x0000000007BA0000-0x0000000007C44000-memory.dmp
memory/4464-54-0x0000000008320000-0x000000000899A000-memory.dmp
memory/4464-55-0x0000000007CE0000-0x0000000007CFA000-memory.dmp
memory/4464-56-0x0000000007D50000-0x0000000007D5A000-memory.dmp
memory/4464-57-0x0000000007F80000-0x0000000008016000-memory.dmp
memory/4464-58-0x0000000007EF0000-0x0000000007F01000-memory.dmp
memory/4464-59-0x0000000007F20000-0x0000000007F2E000-memory.dmp
memory/4464-60-0x0000000007F30000-0x0000000007F45000-memory.dmp
memory/4464-45-0x0000000070AC0000-0x0000000070B0C000-memory.dmp
memory/4464-62-0x0000000008020000-0x0000000008028000-memory.dmp
memory/4464-14-0x0000000003180000-0x00000000031B6000-memory.dmp
memory/4464-44-0x0000000006F60000-0x0000000006F94000-memory.dmp
memory/4464-31-0x0000000006C80000-0x0000000006CCC000-memory.dmp
memory/4464-30-0x0000000006980000-0x000000000699E000-memory.dmp
memory/4464-29-0x00000000064D0000-0x0000000006827000-memory.dmp
memory/4464-22-0x0000000006460000-0x00000000064C6000-memory.dmp
memory/4464-21-0x0000000006340000-0x00000000063A6000-memory.dmp
memory/4464-20-0x0000000005AF0000-0x0000000005B12000-memory.dmp
memory/4464-18-0x0000000005CA0000-0x00000000062CA000-memory.dmp
memory/4464-15-0x0000000005660000-0x0000000005670000-memory.dmp
memory/5016-63-0x0000000005010000-0x0000000005022000-memory.dmp