Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 10:41
General
- Target f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e.exe
- Size 872KB
- Sample260910-mra95abj6x
- SHA256 f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
Malware Config
Extracted
-
formbook
-
4.1
-
ge11
-
treelightproperties.com
-
auditloglink.xyz
-
s9s9u.com
-
dadesports.online
-
naisongwativenga.online
-
horne.biz
-
smartroi.com.au
-
rbizns.com
-
q15v.cn
-
kfhm.com
-
ackexy.top
-
peaknesai.xyz
-
londi.tech
-
atriotbrotherspodcast.com
-
onogame1.com
-
dnczucbsai.com.cn
-
nssonai.com
-
rico808.com
-
betreasgames.ru
-
realgrab.ru
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e.exe"C:\Users\Admin\AppData\Local\Temp\f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e.exe"C:\Users\Admin\AppData\Local\Temp\f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5900-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/5900-16-0x0000000001240000-0x00000000015B4000-memory.dmp
memory/5936-31-0x0000000006450000-0x0000000006470000-memory.dmp
memory/5936-15-0x0000000005210000-0x000000000585A000-memory.dmp
memory/5936-40-0x0000000074970000-0x000000007512C000-memory.dmp
memory/5936-38-0x0000000074970000-0x000000007512C000-memory.dmp
memory/5936-36-0x0000000007250000-0x000000000725A000-memory.dmp
memory/5936-37-0x0000000007450000-0x00000000074E6000-memory.dmp
memory/5936-35-0x00000000071E0000-0x00000000071FA000-memory.dmp
memory/5936-34-0x0000000007820000-0x0000000007E9C000-memory.dmp
memory/5936-33-0x0000000074970000-0x000000007512C000-memory.dmp
memory/5936-20-0x00000000051D0000-0x00000000051F2000-memory.dmp
memory/5936-22-0x0000000005940000-0x00000000059A6000-memory.dmp
memory/5936-26-0x0000000074970000-0x000000007512C000-memory.dmp
memory/5936-12-0x0000000002620000-0x0000000002656000-memory.dmp
memory/5936-14-0x0000000074970000-0x000000007512C000-memory.dmp
memory/5936-32-0x00000000070C0000-0x0000000007163000-memory.dmp
memory/5936-28-0x0000000070C50000-0x0000000070C9C000-memory.dmp
memory/5936-27-0x0000000007080000-0x00000000070B6000-memory.dmp
memory/5936-21-0x00000000058D0000-0x0000000005936000-memory.dmp
memory/5936-13-0x0000000074982000-0x0000000074983000-memory.dmp
memory/5936-23-0x0000000005AB0000-0x0000000005E0B000-memory.dmp
memory/5936-24-0x0000000005E70000-0x0000000005E8E000-memory.dmp
memory/5936-25-0x0000000006400000-0x000000000644C000-memory.dmp
memory/6076-2-0x0000000005A30000-0x0000000005FEA000-memory.dmp
memory/6076-3-0x0000000005390000-0x0000000005422000-memory.dmp
memory/6076-17-0x0000000074970000-0x000000007512C000-memory.dmp
memory/6076-0-0x0000000074982000-0x0000000074983000-memory.dmp
memory/6076-1-0x00000000008D0000-0x00000000009B0000-memory.dmp
memory/6076-10-0x00000000069F0000-0x0000000006AB8000-memory.dmp
memory/6076-9-0x0000000074970000-0x000000007512C000-memory.dmp
memory/6076-8-0x0000000074982000-0x0000000074983000-memory.dmp
memory/6076-7-0x0000000005820000-0x0000000005832000-memory.dmp
memory/6076-6-0x0000000074970000-0x000000007512C000-memory.dmp
memory/6076-5-0x0000000005430000-0x000000000543A000-memory.dmp
memory/6076-4-0x0000000005540000-0x00000000055DC000-memory.dmp