Analysis
- max time kernel
300s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 16:49
General
- Target Sales Contract USD314,298.50.exe
- Size 694KB
- Sample260925-vb3nfasx4p
- SHA256 fe15f3c14abda3b58799555e7700cdf92ca912c5eb1db9f7eae81f60513ad5ff
Malware Config
Extracted
-
formbook
-
4.1
-
me26
-
tpsgraphics.com
-
qlcrudr.com
-
wetwillysdetailing.com
-
xulytroxi.vn
-
mysteryboxenkopen.nl
-
319462xx.cc
-
ainelversion.com.br
-
d2nl.top
-
o34wico1.top
-
innwa77.bet
-
dvpprover.xyz
-
liping-pi.eu.cc
-
amoartpintura.com
-
zbbtop12.icu
-
comercializadoravazquez.com
-
en-888casino.com
-
fxxyy.com
-
bcgeu.dev
-
moon-bbsports.com.cn
-
d2qf4t.top
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 61 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sales Contract USD314,298.50.exe"C:\Users\Admin\AppData\Local\Temp\Sales Contract USD314,298.50.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sales Contract USD314,298.50.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Sales Contract USD314,298.50.exe"C:\Users\Admin\AppData\Local\Temp\Sales Contract USD314,298.50.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Create or Modify System Process
1Windows Service
1Process Injection
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/700-24-0x0000000003A20000-0x0000000003B2C000-memory.dmp
memory/1480-42-0x0000000000770000-0x0000000000798000-memory.dmp
memory/4288-41-0x0000000006E30000-0x0000000006ED3000-memory.dmp
memory/4288-49-0x00000000047E0000-0x00000000047F0000-memory.dmp
memory/4288-47-0x00000000071D0000-0x0000000007266000-memory.dmp
memory/4288-46-0x0000000006FD0000-0x0000000006FDA000-memory.dmp
memory/4288-45-0x0000000006F50000-0x0000000006F6A000-memory.dmp
memory/4288-44-0x0000000007600000-0x0000000007C7C000-memory.dmp
memory/4288-50-0x00000000047E0000-0x00000000047F0000-memory.dmp
memory/4288-38-0x00000000047E0000-0x00000000047F0000-memory.dmp
memory/4288-39-0x00000000047E0000-0x00000000047F0000-memory.dmp
memory/4288-40-0x0000000006E10000-0x0000000006E30000-memory.dmp
memory/4288-30-0x0000000005800000-0x0000000005B5B000-memory.dmp
memory/4288-35-0x0000000071220000-0x000000007126C000-memory.dmp
memory/4288-48-0x0000000074F52000-0x0000000074F53000-memory.dmp
memory/4288-18-0x00000000047E0000-0x00000000047F0000-memory.dmp
memory/4288-14-0x00000000023B0000-0x00000000023E6000-memory.dmp
memory/4288-34-0x0000000006BD0000-0x0000000006C06000-memory.dmp
memory/4288-15-0x0000000074F52000-0x0000000074F53000-memory.dmp
memory/4288-33-0x000000007F7B0000-0x000000007F7C0000-memory.dmp
memory/4288-20-0x0000000004E40000-0x000000000548A000-memory.dmp
memory/4288-32-0x0000000005C50000-0x0000000005C9C000-memory.dmp
memory/4288-31-0x0000000005C00000-0x0000000005C1E000-memory.dmp
memory/4288-17-0x00000000047E0000-0x00000000047F0000-memory.dmp
memory/4288-25-0x0000000004D10000-0x0000000004D32000-memory.dmp
memory/4288-26-0x0000000005500000-0x0000000005566000-memory.dmp
memory/4288-27-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/4580-23-0x0000000001510000-0x0000000001525000-memory.dmp
memory/4580-16-0x0000000001010000-0x0000000001384000-memory.dmp
memory/4580-22-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4580-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4632-9-0x0000000007F40000-0x0000000007FDC000-memory.dmp
memory/4632-7-0x0000000074F52000-0x0000000074F53000-memory.dmp
memory/4632-12-0x0000000008A40000-0x0000000008F0C000-memory.dmp
memory/4632-11-0x0000000008510000-0x0000000008A3C000-memory.dmp
memory/4632-10-0x0000000007EA0000-0x0000000007F12000-memory.dmp
memory/4632-0-0x0000000074F52000-0x0000000074F53000-memory.dmp
memory/4632-8-0x0000000074F40000-0x00000000756FC000-memory.dmp
memory/4632-19-0x0000000074F40000-0x00000000756FC000-memory.dmp
memory/4632-6-0x0000000005860000-0x0000000005876000-memory.dmp
memory/4632-5-0x0000000074F40000-0x00000000756FC000-memory.dmp
memory/4632-4-0x0000000005680000-0x000000000568A000-memory.dmp
memory/4632-3-0x00000000056C0000-0x0000000005752000-memory.dmp
memory/4632-2-0x0000000005BE0000-0x000000000619A000-memory.dmp
memory/4632-1-0x0000000000AA0000-0x0000000000B52000-memory.dmp