Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 13:53
General
- Target quotation copy..exe
- Size 845KB
- Sample260930-q7gnmatbkh
- SHA256 de261b8f2629c5bf1c487a14ebee2fb88cf048a2caeac048593187699df42446
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\quotation copy..exe"C:\Users\Admin\AppData\Local\Temp\quotation copy..exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\quotation copy..exe"C:\Users\Admin\AppData\Local\Temp\quotation copy..exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/884-0-0x0000000000490000-0x000000000056A000-memory.dmp
memory/884-1-0x0000000005490000-0x0000000005A34000-memory.dmp
memory/884-2-0x0000000004F80000-0x0000000005012000-memory.dmp
memory/884-3-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/884-4-0x0000000004F60000-0x0000000004F6A000-memory.dmp
memory/884-5-0x0000000005210000-0x0000000005226000-memory.dmp
memory/884-6-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/884-7-0x00000000065A0000-0x000000000663C000-memory.dmp
memory/884-8-0x0000000006500000-0x000000000658A000-memory.dmp
memory/884-9-0x0000000008700000-0x0000000008C2C000-memory.dmp
memory/884-10-0x0000000008C30000-0x00000000090FC000-memory.dmp
memory/5092-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5092-13-0x0000000001110000-0x0000000001156000-memory.dmp
memory/5092-14-0x00000000015D0000-0x000000000191A000-memory.dmp
memory/5092-15-0x0000000001110000-0x0000000001156000-memory.dmp
memory/5092-16-0x0000000001110000-0x0000000001156000-memory.dmp