Analysis
- user interaction
yes - max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/09/2026, 13:32
General
- Target fa1b9b5ce18e505cc485fe8eaedd26abe4053bd0.bat
- Size 5KB
- Sample260914-qs6zza1flf
- SHA256 d1a6f93ba2ca7025ff4c173da66ee4a59665e966667567a71c47829820cb64a7
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fa1b9b5ce18e505cc485fe8eaedd26abe4053bd0.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %Beklaedning% "2⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundtaskhost.exe"C:\Windows\SysWOW64\backgroundtaskhost.exe"3⤵
-
-
C:\Windows\SysWOW64\backgroundtaskhost.exe"C:\Windows\SysWOW64\backgroundtaskhost.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundtaskhost.exe"C:\Windows\SysWOW64\backgroundtaskhost.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_gjifdrf4.f3m.ps1
memory/2228-22-0x0000000008110000-0x00000000086B4000-memory.dmp
memory/2228-24-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/2228-3-0x0000000004B00000-0x0000000004B22000-memory.dmp
memory/2228-4-0x0000000004BC0000-0x0000000004C26000-memory.dmp
memory/2228-5-0x0000000004C30000-0x0000000004C96000-memory.dmp
memory/2228-1-0x0000000002550000-0x0000000002586000-memory.dmp
memory/2228-13-0x0000000005590000-0x00000000058E4000-memory.dmp
memory/2228-14-0x0000000005AE0000-0x0000000005AFE000-memory.dmp
memory/2228-15-0x0000000005B40000-0x0000000005B8C000-memory.dmp
memory/2228-16-0x0000000006070000-0x00000000060B4000-memory.dmp
memory/2228-25-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/2228-18-0x00000000074E0000-0x0000000007B5A000-memory.dmp
memory/2228-19-0x0000000006E80000-0x0000000006E9A000-memory.dmp
memory/2228-20-0x0000000007130000-0x00000000071C6000-memory.dmp
memory/2228-21-0x0000000007040000-0x0000000007062000-memory.dmp
memory/2228-0-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/2228-2-0x0000000004D20000-0x0000000005348000-memory.dmp
memory/2228-23-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/2228-17-0x0000000006BE0000-0x0000000006C56000-memory.dmp
memory/2228-26-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/2228-27-0x0000000007CE0000-0x0000000007CE2000-memory.dmp
memory/2228-28-0x00000000086C0000-0x000000000C284000-memory.dmp
memory/3964-30-0x0000000001050000-0x00000000010A1000-memory.dmp
memory/3964-31-0x0000000077E98000-0x0000000077E99000-memory.dmp
memory/3964-32-0x0000000077F39000-0x0000000077F3A000-memory.dmp
memory/3964-33-0x0000000077EB5000-0x0000000077EB6000-memory.dmp
memory/3964-36-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3964-37-0x0000000077E11000-0x0000000077F31000-memory.dmp
memory/3964-38-0x000000001CBE0000-0x000000001CC26000-memory.dmp
memory/3964-39-0x0000000001050000-0x00000000010A1000-memory.dmp
memory/3964-40-0x000000001CF90000-0x000000001D2DA000-memory.dmp
memory/3964-41-0x0000000077F39000-0x0000000077F3A000-memory.dmp
memory/3964-43-0x000000001CBE0000-0x000000001CC26000-memory.dmp
memory/3964-47-0x000000001CBE0000-0x000000001CC26000-memory.dmp