Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 18:01
General
- Target TENDER_33AAACL1880A1Z4___PAN_No.AAACL1880A.bat.exe
- Size 1.0MB
- Sample260703-wl84msaw2k
- SHA256 fbbb5b74e9d1d24d79f9ca7f8dc44dac9ea7663d666ee829bc5e2d2cbcec3174
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TENDER_33AAACL1880A1Z4___PAN_No.AAACL1880A.bat.exe"C:\Users\Admin\AppData\Local\Temp\TENDER_33AAACL1880A1Z4___PAN_No.AAACL1880A.bat.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TENDER_33AAACL1880A1Z4___PAN_No.AAACL1880A.bat.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\TENDER_33AAACL1880A1Z4___PAN_No.AAACL1880A.bat.exe"C:\Users\Admin\AppData\Local\Temp\TENDER_33AAACL1880A1Z4___PAN_No.AAACL1880A.bat.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 2363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2560 -ip 25601⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2004-37-0x0000000002D30000-0x0000000002D40000-memory.dmp
memory/2004-21-0x00000000056F0000-0x0000000005D3A000-memory.dmp
memory/2004-45-0x0000000074300000-0x0000000074ABC000-memory.dmp
memory/2004-43-0x0000000002D30000-0x0000000002D40000-memory.dmp
memory/2004-42-0x0000000007A60000-0x0000000007AF6000-memory.dmp
memory/2004-41-0x0000000007860000-0x000000000786A000-memory.dmp
memory/2004-39-0x0000000007E30000-0x00000000084AC000-memory.dmp
memory/2004-40-0x00000000077F0000-0x000000000780A000-memory.dmp
memory/2004-32-0x0000000007650000-0x0000000007686000-memory.dmp
memory/2004-33-0x0000000072A40000-0x0000000072A8C000-memory.dmp
memory/2004-38-0x00000000076B0000-0x0000000007753000-memory.dmp
memory/2004-20-0x0000000002D30000-0x0000000002D40000-memory.dmp
memory/2004-36-0x0000000006A70000-0x0000000006A90000-memory.dmp
memory/2004-31-0x000000007F8A0000-0x000000007F8B0000-memory.dmp
memory/2004-29-0x0000000006530000-0x000000000657C000-memory.dmp
memory/2004-28-0x00000000064A0000-0x00000000064BE000-memory.dmp
memory/2004-16-0x0000000074312000-0x0000000074313000-memory.dmp
memory/2004-18-0x0000000074300000-0x0000000074ABC000-memory.dmp
memory/2004-17-0x0000000002C70000-0x0000000002CA6000-memory.dmp
memory/2004-27-0x0000000006100000-0x000000000645B000-memory.dmp
memory/2004-23-0x0000000005DB0000-0x0000000005E16000-memory.dmp
memory/2004-24-0x0000000005E20000-0x0000000005E86000-memory.dmp
memory/2012-11-0x0000000074312000-0x0000000074313000-memory.dmp
memory/2012-7-0x0000000005190000-0x000000000519A000-memory.dmp
memory/2012-1-0x0000000000090000-0x00000000001A0000-memory.dmp
memory/2012-2-0x0000000005270000-0x000000000582A000-memory.dmp
memory/2012-3-0x0000000004CB0000-0x000000000500B000-memory.dmp
memory/2012-4-0x00000000050B0000-0x0000000005142000-memory.dmp
memory/2012-5-0x0000000005030000-0x0000000005042000-memory.dmp
memory/2012-13-0x0000000006860000-0x0000000006940000-memory.dmp
memory/2012-0-0x0000000074312000-0x0000000074313000-memory.dmp
memory/2012-12-0x0000000074300000-0x0000000074ABC000-memory.dmp
memory/2012-10-0x00000000066C0000-0x000000000675C000-memory.dmp
memory/2012-9-0x0000000005970000-0x0000000005982000-memory.dmp
memory/2012-8-0x0000000074300000-0x0000000074ABC000-memory.dmp
memory/2012-22-0x0000000074300000-0x0000000074ABC000-memory.dmp
memory/2012-6-0x0000000005080000-0x00000000050A2000-memory.dmp
memory/2560-30-0x0000000001300000-0x0000000001346000-memory.dmp
memory/2560-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2560-15-0x0000000001300000-0x0000000001346000-memory.dmp
memory/2560-19-0x00000000018D0000-0x0000000001C44000-memory.dmp