Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/09/2026, 21:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
forc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target forc.exe
- Size 11.9MB
- Sample260906-1p341stbrf
- SHA256 1a0d522295ceb6dd8291d0c65b411fec82bf710facf170db56c344657b133999
- MD5 0cc99cdea69fdf1c2eb4a1bb274e73a8
- SHA1 ec7268cb8116b420a4580bd8865400fdf8b0e8e3
- SHA512 3b20482725245ef3d879f09c069ddbfd7d4907eca2a8d05cc6d31c3175a427f4bd877894440b91c0cbb9607b5ec681e5dbb533c05fb69a0f741c1595a9b2e1a8
- SSDEEP 196608:lrDVhJ7klBTxVY4g/peTX0GiIIiw7lpMISy297mkktp:RDPstDmeThiIIiwppMISy2rwp
- TLSH T13CC6BF56E2FD00E8D5BAC0B8C6574627EBB23455133067EB16A08A692F37FE16E7D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 46 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe forc.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe forc.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe forc.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\classfile_constants.h forc.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jawt.h forc.exe File opened for modification C:\Program Files\7-Zip\7z.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe forc.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe forc.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe forc.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe forc.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jni.h forc.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe forc.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe forc.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h forc.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmti.h forc.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe forc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE forc.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe forc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe forc.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe forc.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe forc.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe forc.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe forc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe forc.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe forc.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe forc.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe forc.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe forc.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe forc.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe forc.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h forc.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe forc.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe forc.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe forc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe forc.exe File opened for modification C:\Program Files\Windows Defender\MpDefenderCoreService.exe forc.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe forc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe forc.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\INF\Outlook\outlperf.h forc.exe File opened for modification C:\Windows\INF\SMSvcHost 3.0.0.0\_SMSvcHostPerfCounters.h forc.exe File created C:\Windows\INF\BITS\bitsctr.h forc.exe File created C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h forc.exe File created C:\Windows\INF\RemoteAccess\rasctrnm.h forc.exe File opened for modification C:\Windows\INF\ServiceModelOperation 3.0.0.0\_ServiceModelOperationPerfCounters.h forc.exe File opened for modification C:\Windows\INF\ServiceModelService 3.0.0.0\_ServiceModelServicePerfCounters.h forc.exe File created C:\Windows\INF\.NET CLR Data\_DataPerfCounters.h forc.exe File created C:\Windows\INF\.NET CLR Networking 4.0.0.0\_NetworkingPerfCounters.h forc.exe File created C:\Windows\INF\.NET Data Provider for SqlServer\_dataperfcounters_shared12_neutral.h forc.exe File created C:\Windows\INF\MSDTC\msdtcprf.h forc.exe File opened for modification C:\Windows\INF\MSDTC Bridge 3.0.0.0\_TransactionBridgePerfCounters.h forc.exe File created C:\Windows\INF\MSDTC Bridge 4.0.0.0\_TransactionBridgePerfCounters.h forc.exe File opened for modification C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\_ServiceModelEndpointPerfCounters.h forc.exe File created C:\Windows\INF\.NET CLR Networking\_NetworkingPerfCounters_v2.h forc.exe File created C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h forc.exe File created C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.h forc.exe File created C:\Windows\INF\.NETFramework\CORPerfMonSymbols.h forc.exe File created C:\Windows\INF\LSM\lagcounterdef.h forc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 forc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString forc.exe