Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 03:48
General
- Target Image_Image capture Image_Image capture 1002600 JPG1002600 JPG.exe
- Size 1.1MB
- Sample260818-ec57ysvhqa
- SHA256 1b8f695e81cf35bf4ef384a33babed87f8bac54befc7d03c4b9d1c216edab253
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 3 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Image_Image capture Image_Image capture 1002600 JPG1002600 JPG.exe"C:\Users\Admin\AppData\Local\Temp\Image_Image capture Image_Image capture 1002600 JPG1002600 JPG.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Image_Image capture Image_Image capture 1002600 JPG1002600 JPG.exe"C:\Users\Admin\AppData\Local\Temp\Image_Image capture Image_Image capture 1002600 JPG1002600 JPG.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$imkc13=[System.Environment]::TickCount;$xooajz=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$imkc13=[System.Environment]::TickCount;$trw35m=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXFVzSlRhQ1RIbHhHaWVlLmV4ZQ==')));$imkc13=[System.Environment]::TickCount;& $xooajz -FilePath $trw35m"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\UsJTaCTHlxGiee.exe"C:\Users\Admin\AppData\Roaming\UsJTaCTHlxGiee.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\UsJTaCTHlxGiee.exe"C:\Users\Admin\AppData\Roaming\UsJTaCTHlxGiee.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\UsJTaCTHlxGiee.exe"C:\Users\Admin\AppData\Roaming\UsJTaCTHlxGiee.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\Utilman.exe"C:\Windows\SysWOW64\Utilman.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
UsJTaCTHlxGiee.exe
memory/1900-40-0x0000000000330000-0x0000000000373000-memory.dmp
memory/1900-36-0x0000000000330000-0x0000000000373000-memory.dmp
memory/2016-12-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2016-39-0x0000000000F40000-0x0000000000F86000-memory.dmp
memory/2016-37-0x0000000000F40000-0x0000000000F86000-memory.dmp
memory/2016-26-0x0000000000F40000-0x0000000000F86000-memory.dmp
memory/2016-15-0x0000000001320000-0x0000000001694000-memory.dmp
memory/2016-13-0x0000000000F40000-0x0000000000F86000-memory.dmp
memory/4156-41-0x0000000003F00000-0x0000000003FB9000-memory.dmp
memory/4184-51-0x0000025350520000-0x000002535060D000-memory.dmp
memory/4236-33-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-28-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-34-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-30-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-29-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-16-0x00007FFC7307F000-0x00007FFC73080000-memory.dmp
memory/4236-17-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-18-0x0000016E3B740000-0x0000016E3B762000-memory.dmp
memory/4236-19-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-20-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-23-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-24-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-25-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4236-27-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4632-10-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/4632-2-0x0000000005330000-0x00000000058EA000-memory.dmp
memory/4632-9-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/4632-14-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/4632-7-0x0000000004F80000-0x0000000004FA4000-memory.dmp
memory/4632-0-0x0000000074E82000-0x0000000074E83000-memory.dmp
memory/4632-11-0x0000000006690000-0x0000000006778000-memory.dmp
memory/4632-6-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/4632-8-0x0000000074E82000-0x0000000074E83000-memory.dmp
memory/4632-5-0x0000000005000000-0x000000000509C000-memory.dmp
memory/4632-1-0x00000000002A0000-0x00000000003BA000-memory.dmp
memory/4632-4-0x0000000004D90000-0x0000000004D9A000-memory.dmp
memory/4632-3-0x0000000004E10000-0x0000000004EA2000-memory.dmp
memory/4656-38-0x0000000000250000-0x0000000002A0F000-memory.dmp
memory/4656-35-0x0000000000250000-0x0000000002A0F000-memory.dmp