Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 09:40
General
- Target PIO2342_1.exe
- Size 1.1MB
- Sample260924-lnmcjsaf58
- SHA256 cbdb3ea53fb36a7fa4746c690b52d55d5c9fca386e246a40fdff1e0c5ac15a93
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PIO2342_1.exe"C:\Users\Admin\AppData\Local\Temp\PIO2342_1.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PIO2342_1.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PIO2342_1.exe"C:\Users\Admin\AppData\Local\Temp\PIO2342_1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1788-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1788-43-0x00000000010E0000-0x0000000001126000-memory.dmp
memory/1788-44-0x00000000010E0000-0x0000000001126000-memory.dmp
memory/1788-12-0x00000000010E0000-0x0000000001126000-memory.dmp
memory/1788-18-0x0000000001750000-0x0000000001AC4000-memory.dmp
memory/2084-4-0x0000000005580000-0x000000000558A000-memory.dmp
memory/2084-6-0x0000000074BD0000-0x000000007538C000-memory.dmp
memory/2084-7-0x0000000009000000-0x000000000901A000-memory.dmp
memory/2084-8-0x0000000074BE2000-0x0000000074BE3000-memory.dmp
memory/2084-9-0x0000000074BD0000-0x000000007538C000-memory.dmp
memory/2084-10-0x00000000094F0000-0x00000000095DA000-memory.dmp
memory/2084-5-0x0000000005740000-0x00000000057DC000-memory.dmp
memory/2084-3-0x00000000054C0000-0x0000000005552000-memory.dmp
memory/2084-2-0x0000000005B40000-0x00000000060FA000-memory.dmp
memory/2084-1-0x00000000009D0000-0x0000000000AE8000-memory.dmp
memory/2084-0-0x0000000074BE2000-0x0000000074BE3000-memory.dmp
memory/2084-19-0x0000000074BD0000-0x000000007538C000-memory.dmp
memory/5724-22-0x0000000005750000-0x00000000057B6000-memory.dmp
memory/5724-34-0x0000000005160000-0x0000000005170000-memory.dmp
memory/5724-17-0x0000000074BD0000-0x000000007538C000-memory.dmp
memory/5724-14-0x0000000074BE2000-0x0000000074BE3000-memory.dmp
memory/5724-20-0x00000000055D0000-0x00000000055F2000-memory.dmp
memory/5724-21-0x0000000005670000-0x00000000056D6000-memory.dmp
memory/5724-25-0x0000000006120000-0x000000000647B000-memory.dmp
memory/5724-26-0x0000000006490000-0x00000000064AE000-memory.dmp
memory/5724-27-0x00000000064D0000-0x000000000651C000-memory.dmp
memory/5724-29-0x0000000006A80000-0x0000000006AB6000-memory.dmp
memory/5724-33-0x0000000006AC0000-0x0000000006AE0000-memory.dmp
memory/5724-16-0x00000000057C0000-0x0000000005E0A000-memory.dmp
memory/5724-30-0x0000000070EB0000-0x0000000070EFC000-memory.dmp
memory/5724-35-0x00000000076B0000-0x0000000007753000-memory.dmp
memory/5724-28-0x000000007FB90000-0x000000007FBA0000-memory.dmp
memory/5724-36-0x0000000007E50000-0x00000000084CC000-memory.dmp
memory/5724-37-0x0000000007810000-0x000000000782A000-memory.dmp
memory/5724-38-0x0000000007880000-0x000000000788A000-memory.dmp
memory/5724-39-0x0000000007A80000-0x0000000007B16000-memory.dmp
memory/5724-40-0x0000000005160000-0x0000000005170000-memory.dmp
memory/5724-42-0x0000000074BD0000-0x000000007538C000-memory.dmp
memory/5724-15-0x0000000074BD0000-0x000000007538C000-memory.dmp
memory/5724-13-0x0000000004FD0000-0x0000000005006000-memory.dmp