Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 05:57
General
- Target quote.exe
- Size 1.1MB
- Sample260723-gnvxgagh93
- SHA256 198906594ae1cb1951d6e75e1921a7dd1188c8356371b847556ff15226dc5e83
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\quote.exe"C:\Users\Admin\AppData\Local\Temp\quote.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\quote.exe"C:\Users\Admin\AppData\Local\Temp\quote.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4920-0-0x0000000074E32000-0x0000000074E33000-memory.dmp
memory/4920-1-0x0000000000C90000-0x0000000000DBC000-memory.dmp
memory/4920-2-0x0000000005DA0000-0x000000000635A000-memory.dmp
memory/4920-3-0x00000000058D0000-0x0000000005962000-memory.dmp
memory/4920-4-0x0000000005A10000-0x0000000005AAC000-memory.dmp
memory/4920-5-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/4920-6-0x0000000005970000-0x00000000059DA000-memory.dmp
memory/4920-72-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-74-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-132-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-130-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-128-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-126-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-124-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-122-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-120-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-118-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-116-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-112-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-110-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-108-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-106-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-104-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-102-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-100-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-98-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-96-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-94-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-92-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-90-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-88-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-86-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-84-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-83-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-79-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-76-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-70-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-68-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-66-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-64-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-62-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-60-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-58-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-56-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-54-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-52-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-50-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-48-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-42-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-40-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-36-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-34-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-30-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-28-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-24-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-22-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-18-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-16-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-14-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-12-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-134-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-114-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-46-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-44-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-38-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-32-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-26-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-20-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-10-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-8-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-7-0x0000000005970000-0x00000000059FD000-memory.dmp
memory/4920-551-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/4920-552-0x0000000005BA0000-0x0000000005BAA000-memory.dmp
memory/4920-553-0x0000000005CD0000-0x0000000005CF8000-memory.dmp
memory/4920-554-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/4920-555-0x0000000074E32000-0x0000000074E33000-memory.dmp
memory/4920-556-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/4920-557-0x0000000008A00000-0x0000000008A2A000-memory.dmp
memory/4920-682-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/4920-683-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/4920-686-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/5096-685-0x00000000010A0000-0x00000000010E6000-memory.dmp
memory/5096-687-0x0000000001470000-0x00000000017E4000-memory.dmp
memory/5096-688-0x00000000010A0000-0x00000000010E6000-memory.dmp
memory/5096-689-0x00000000010A0000-0x00000000010E6000-memory.dmp