Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/06/2026, 15:21
General
- Target Purchase Order_Data sheet for 20ft.js
- Size 1.5MB
- Sample260622-src2lsdz5v
- SHA256 331712785d2f4d9f0a25a558d3e8782652c6ec026d96c2fa67bbad0db15e941e
Malware Config
Extracted
-
formbook
-
4.1
-
m02s
-
n552092.top
-
oglhuber.ai
-
arrowduo.com
-
magieai.com
-
4h8u8yrp.top
-
otalis.ch
-
sonovell.shop
-
ahmads-appdev.com
-
fadegrips.store
-
clubcanintremblay.fr
-
solosystem.cc
-
init-united26odds.com
-
harmonyhomeapex.com
-
rockacoffee.nl
-
zha-shijiebei2026.com.cn
-
purposequeen.com
-
maisonduchou.net
-
govws.cyou
-
echophotonbase.info
-
89end1.sbs
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order_Data sheet for 20ft.js"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -w H -NOP -NoNi -Command ". ([scriptblock]::Create($env:xGnTD15mgIMd))"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -w H -NOP -NoNi -Command ". ([scriptblock]::Create($env:xGnTD15mgIMd))"4⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xkgarn00.4a4.ps1
memory/3232-25-0x0000000008B60000-0x0000000008C27000-memory.dmp
memory/3900-14-0x0000000000790000-0x00000000007BF000-memory.dmp
memory/3900-20-0x0000000000790000-0x00000000007BF000-memory.dmp
memory/4696-8-0x0000025873D50000-0x0000025873D72000-memory.dmp
memory/4696-11-0x00000258714F0000-0x0000025871500000-memory.dmp
memory/4696-10-0x0000025871480000-0x00000258714DA000-memory.dmp
memory/4696-19-0x0000025876480000-0x0000025876582000-memory.dmp
memory/4696-1-0x0000025874000000-0x0000025874010000-memory.dmp
memory/4696-0-0x0000025874000000-0x0000025874010000-memory.dmp
memory/4920-21-0x0000000000650000-0x000000000078A000-memory.dmp
memory/4920-22-0x0000000000650000-0x000000000078A000-memory.dmp
memory/4920-23-0x0000000000D20000-0x0000000000D4F000-memory.dmp