Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 16:07
General
- Target 4e34087740b707b6f8202bf5727f2bb75b1d6dfd9940dcca2e61ed7f54173b25.exe
- Size 985KB
- Sample260707-tkwe2shz5m
- SHA256 4e34087740b707b6f8202bf5727f2bb75b1d6dfd9940dcca2e61ed7f54173b25
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e34087740b707b6f8202bf5727f2bb75b1d6dfd9940dcca2e61ed7f54173b25.exe"C:\Users\Admin\AppData\Local\Temp\4e34087740b707b6f8202bf5727f2bb75b1d6dfd9940dcca2e61ed7f54173b25.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3216-8-0x0000000074552000-0x0000000074553000-memory.dmp
memory/3216-9-0x0000000074540000-0x0000000074CFC000-memory.dmp
memory/3216-2-0x0000000005340000-0x00000000058FA000-memory.dmp
memory/3216-3-0x0000000004D80000-0x0000000004E12000-memory.dmp
memory/3216-4-0x0000000004E20000-0x0000000004EBC000-memory.dmp
memory/3216-5-0x0000000004D10000-0x0000000004D1A000-memory.dmp
memory/3216-6-0x0000000074540000-0x0000000074CFC000-memory.dmp
memory/3216-7-0x0000000004F20000-0x0000000004F2E000-memory.dmp
memory/3216-1-0x00000000000F0000-0x00000000001EC000-memory.dmp
memory/3216-10-0x00000000071D0000-0x00000000072B0000-memory.dmp
memory/3216-0-0x0000000074552000-0x0000000074553000-memory.dmp
memory/3216-13-0x0000000074540000-0x0000000074CFC000-memory.dmp
memory/5640-12-0x0000000001130000-0x0000000001176000-memory.dmp
memory/5640-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5640-14-0x0000000001510000-0x0000000001884000-memory.dmp
memory/5640-15-0x0000000001130000-0x0000000001176000-memory.dmp
memory/5640-16-0x0000000001130000-0x0000000001176000-memory.dmp