formbook | 4d6930feaf120f23b36ead33017b972a8a2190537cce3b68b888b9959caf5c34

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sevv.ps1
Size 1.4MB
Sample261007-wjpl8acw3v
SHA256 4d6930feaf120f23b36ead33017b972a8a2190537cce3b68b888b9959caf5c34
MD5 5d756f6252b75fba78ebe9a8fd0da4db
SHA1 42269c59d4484c47725029e335e846a74fd77729
SHA512 3299e5cdc0229095e9d826e087bfd1f42152b9b9446453dcdef7fb9dbaa9928f2ea1cc9b20a0351375812b95af9c9ca626cc4b488db8524f94532bf57e46e6c5
SSDEEP 24576:2den9gopTCfjXtcrh8tupSM5ZWojljA6CC+WvoKvLPQzLowuuNapmGDjxaVS5T8U:YenpC7tBupSMZjA6Z3bkHskbVS5P
TLSH
T1F56523719D6822FD8E12E2F96A52A4C4F08926CF4EC20327935C46F63BF9075985BD73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution formbook privilege_escalation rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 10 IoCs

rat

resource	yara_rule
behavioral2/memory/3744-20-0x0000000000C60000-0x0000000000CA6000-memory.dmp	family_formbook
behavioral2/memory/3744-35-0x0000000000C60000-0x0000000000CA6000-memory.dmp	family_formbook
behavioral2/memory/3744-34-0x0000000000C60000-0x0000000000CA6000-memory.dmp	family_formbook
behavioral2/memory/3744-38-0x0000000000C60000-0x0000000000CA6000-memory.dmp	family_formbook
behavioral2/memory/3744-41-0x0000000000C60000-0x0000000000CA6000-memory.dmp	family_formbook
behavioral2/memory/2104-44-0x0000000001240000-0x0000000001283000-memory.dmp	family_formbook
behavioral2/memory/5472-49-0x00000000010D0000-0x0000000001116000-memory.dmp	family_formbook
behavioral2/memory/5472-51-0x00000000010D0000-0x0000000001116000-memory.dmp	family_formbook
behavioral2/memory/2104-52-0x0000000001240000-0x0000000001283000-memory.dmp	family_formbook
behavioral2/memory/4784-57-0x0000000001580000-0x00000000015C6000-memory.dmp	family_formbook

Badlisted process makes network request 29 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	5932	PowerShell.exe
9	5932	PowerShell.exe
10	5932	PowerShell.exe
11	5932	PowerShell.exe
12	5932	PowerShell.exe
14	5932	PowerShell.exe
15	5932	PowerShell.exe
16	5932	PowerShell.exe
17	5932	PowerShell.exe
18	5932	PowerShell.exe
19	5932	PowerShell.exe
20	5932	PowerShell.exe
21	5932	PowerShell.exe
22	5932	PowerShell.exe
23	5932	PowerShell.exe
24	5932	PowerShell.exe
25	5932	PowerShell.exe
26	5932	PowerShell.exe
27	5932	PowerShell.exe
28	5932	PowerShell.exe
29	5932	PowerShell.exe
30	5932	PowerShell.exe
31	5932	PowerShell.exe
32	5932	PowerShell.exe
33	5932	PowerShell.exe
35	5932	PowerShell.exe
36	5932	PowerShell.exe
37	5932	PowerShell.exe
38	5932	PowerShell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	convert.exe

Suspicious use of SetThreadContext 28 IoCs

description	pid	Process	procid_target
PID 5932 set thread context of 3744	5932	PowerShell.exe	95
PID 3744 set thread context of 5932	3744	aspnet_compiler.exe	87
PID 3744 set thread context of 2104	3744	aspnet_compiler.exe	96
PID 5932 set thread context of 5472	5932	PowerShell.exe	98
PID 2104 set thread context of 5932	2104	convert.exe	87
PID 5932 set thread context of 4784	5932	PowerShell.exe	99
PID 5932 set thread context of 5620	5932	PowerShell.exe	100
PID 5932 set thread context of 5200	5932	PowerShell.exe	103
PID 2104 set thread context of 6132	2104	convert.exe	101
PID 5932 set thread context of 2440	5932	PowerShell.exe	104
PID 5932 set thread context of 5920	5932	PowerShell.exe	105
PID 5932 set thread context of 3328	5932	PowerShell.exe	110
PID 5932 set thread context of 1132	5932	PowerShell.exe	111
PID 5932 set thread context of 3004	5932	PowerShell.exe	112
PID 5932 set thread context of 5732	5932	PowerShell.exe	113
PID 5932 set thread context of 2700	5932	PowerShell.exe	114
PID 5932 set thread context of 4712	5932	PowerShell.exe	115
PID 5932 set thread context of 908	5932	PowerShell.exe	116
PID 5932 set thread context of 4608	5932	PowerShell.exe	118
PID 5932 set thread context of 4764	5932	PowerShell.exe	119
PID 5932 set thread context of 4772	5932	PowerShell.exe	120
PID 5932 set thread context of 4304	5932	PowerShell.exe	121
PID 5932 set thread context of 1496	5932	PowerShell.exe	122
PID 5932 set thread context of 5220	5932	PowerShell.exe	123
PID 5932 set thread context of 4332	5932	PowerShell.exe	124
PID 5932 set thread context of 3928	5932	PowerShell.exe	125
PID 5932 set thread context of 1288	5932	PowerShell.exe	126
PID 5932 set thread context of 4392	5932	PowerShell.exe	128

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5932	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	convert.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	convert.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1404337215-1550464601-2805570857-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	convert.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
3744	aspnet_compiler.exe
3744	aspnet_compiler.exe
3744	aspnet_compiler.exe
3744	aspnet_compiler.exe
5932	PowerShell.exe
5932	PowerShell.exe
2104	convert.exe
2104	convert.exe
2104	convert.exe
2104	convert.exe
5932	PowerShell.exe
5472	aspnet_compiler.exe
5932	PowerShell.exe
4784	aspnet_compiler.exe
5932	PowerShell.exe
5620	aspnet_compiler.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5200	aspnet_compiler.exe
5932	PowerShell.exe
2440	aspnet_compiler.exe
5932	PowerShell.exe
5920	aspnet_compiler.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
3328	aspnet_compiler.exe
5932	PowerShell.exe
1132	aspnet_compiler.exe
5932	PowerShell.exe
3004	aspnet_compiler.exe
5932	PowerShell.exe
5732	aspnet_compiler.exe
5932	PowerShell.exe
2700	aspnet_compiler.exe
5932	PowerShell.exe
4712	aspnet_compiler.exe
5932	PowerShell.exe
908	aspnet_compiler.exe
5932	PowerShell.exe
5932	PowerShell.exe
5932	PowerShell.exe
4608	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 1 TTPs 7 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3744	aspnet_compiler.exe
5932	PowerShell.exe
5932	PowerShell.exe
2104	convert.exe
2104	convert.exe
2104	convert.exe
2104	convert.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5932	PowerShell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 4812	5932	PowerShell.exe	90
PID 5932 wrote to memory of 5444	5932	PowerShell.exe	91
PID 5932 wrote to memory of 944	5932	PowerShell.exe	92
PID 5932 wrote to memory of 2508	5932	PowerShell.exe	93
PID 5932 wrote to memory of 712	5932	PowerShell.exe	94
PID 5932 wrote to memory of 3744	5932	PowerShell.exe	95
PID 5932 wrote to memory of 3744	5932	PowerShell.exe	95
PID 5932 wrote to memory of 3744	5932	PowerShell.exe	95
PID 5932 wrote to memory of 2104	5932	PowerShell.exe	96
PID 5932 wrote to memory of 5472	5932	PowerShell.exe	98
PID 5932 wrote to memory of 5472	5932	PowerShell.exe	98
PID 5932 wrote to memory of 5472	5932	PowerShell.exe	98
PID 5932 wrote to memory of 4784	5932	PowerShell.exe	99
PID 5932 wrote to memory of 4784	5932	PowerShell.exe	99
PID 5932 wrote to memory of 4784	5932	PowerShell.exe	99
PID 5932 wrote to memory of 5620	5932	PowerShell.exe	100
PID 5932 wrote to memory of 5620	5932	PowerShell.exe	100
PID 5932 wrote to memory of 5620	5932	PowerShell.exe	100
PID 2104 wrote to memory of 6132	2104	convert.exe	101
PID 5932 wrote to memory of 1368	5932	PowerShell.exe	102
PID 5932 wrote to memory of 5200	5932	PowerShell.exe	103
PID 5932 wrote to memory of 5200	5932	PowerShell.exe	103
PID 5932 wrote to memory of 5200	5932	PowerShell.exe	103
PID 5932 wrote to memory of 2440	5932	PowerShell.exe	104
PID 5932 wrote to memory of 2440	5932	PowerShell.exe	104
PID 5932 wrote to memory of 2440	5932	PowerShell.exe	104
PID 5932 wrote to memory of 5920	5932	PowerShell.exe	105
PID 5932 wrote to memory of 5920	5932	PowerShell.exe	105
PID 5932 wrote to memory of 5920	5932	PowerShell.exe	105
PID 5932 wrote to memory of 1616	5932	PowerShell.exe	106
PID 5932 wrote to memory of 2848	5932	PowerShell.exe	107
PID 5932 wrote to memory of 5880	5932	PowerShell.exe	108
PID 5932 wrote to memory of 5040	5932	PowerShell.exe	109
PID 5932 wrote to memory of 3328	5932	PowerShell.exe	110
PID 5932 wrote to memory of 3328	5932	PowerShell.exe	110
PID 5932 wrote to memory of 3328	5932	PowerShell.exe	110
PID 5932 wrote to memory of 1132	5932	PowerShell.exe	111
PID 5932 wrote to memory of 1132	5932	PowerShell.exe	111
PID 5932 wrote to memory of 1132	5932	PowerShell.exe	111
PID 5932 wrote to memory of 3004	5932	PowerShell.exe	112
PID 5932 wrote to memory of 3004	5932	PowerShell.exe	112
PID 5932 wrote to memory of 3004	5932	PowerShell.exe	112
PID 5932 wrote to memory of 5732	5932	PowerShell.exe	113
PID 5932 wrote to memory of 5732	5932	PowerShell.exe	113
PID 5932 wrote to memory of 5732	5932	PowerShell.exe	113
PID 5932 wrote to memory of 2700	5932	PowerShell.exe	114
PID 5932 wrote to memory of 2700	5932	PowerShell.exe	114
PID 5932 wrote to memory of 2700	5932	PowerShell.exe	114
PID 5932 wrote to memory of 4712	5932	PowerShell.exe	115
PID 5932 wrote to memory of 4712	5932	PowerShell.exe	115
PID 5932 wrote to memory of 4712	5932	PowerShell.exe	115
PID 5932 wrote to memory of 908	5932	PowerShell.exe	116
PID 5932 wrote to memory of 908	5932	PowerShell.exe	116
PID 5932 wrote to memory of 908	5932	PowerShell.exe	116
PID 5932 wrote to memory of 5568	5932	PowerShell.exe	117
PID 5932 wrote to memory of 4608	5932	PowerShell.exe	118
PID 5932 wrote to memory of 4608	5932	PowerShell.exe	118
PID 5932 wrote to memory of 4608	5932	PowerShell.exe	118
PID 5932 wrote to memory of 4764	5932	PowerShell.exe	119
PID 5932 wrote to memory of 4764	5932	PowerShell.exe	119
PID 5932 wrote to memory of 4764	5932	PowerShell.exe	119
PID 5932 wrote to memory of 4772	5932	PowerShell.exe	120
PID 5932 wrote to memory of 4772	5932	PowerShell.exe	120
PID 5932 wrote to memory of 4772	5932	PowerShell.exe	120

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	convert.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sevv.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3744
- C:\Windows\SysWOW64\convert.exe
  "C:\Windows\SysWOW64\convert.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:2104
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:6132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-43-0x0000000001B60000-0x0000000001ED4000-memory.dmp

Download

memory/2104-44-0x0000000001240000-0x0000000001283000-memory.dmp

Download

memory/2104-39-0x0000000001240000-0x0000000001283000-memory.dmp

Download

memory/2104-40-0x0000000001240000-0x0000000001283000-memory.dmp

Download

memory/2104-53-0x0000000001A60000-0x0000000001B01000-memory.dmp

Download

memory/2104-52-0x0000000001240000-0x0000000001283000-memory.dmp

Download

memory/2104-60-0x0000000001A60000-0x0000000001B01000-memory.dmp

Download

memory/3744-20-0x0000000000C60000-0x0000000000CA6000-memory.dmp

Download

memory/3744-38-0x0000000000C60000-0x0000000000CA6000-memory.dmp

Download

memory/3744-35-0x0000000000C60000-0x0000000000CA6000-memory.dmp

Download

memory/3744-34-0x0000000000C60000-0x0000000000CA6000-memory.dmp

Download

memory/3744-41-0x0000000000C60000-0x0000000000CA6000-memory.dmp

Download

memory/3744-31-0x0000000001040000-0x00000000013B4000-memory.dmp

Download

memory/3744-36-0x0000000001DD0000-0x0000000001DF2000-memory.dmp

Download

memory/3744-42-0x0000000001DD0000-0x0000000001DF2000-memory.dmp

Download

memory/3744-18-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4784-58-0x0000000001950000-0x0000000001CC4000-memory.dmp

Download

memory/4784-57-0x0000000001580000-0x00000000015C6000-memory.dmp

Download

memory/5472-49-0x00000000010D0000-0x0000000001116000-memory.dmp

Download

memory/5472-51-0x00000000010D0000-0x0000000001116000-memory.dmp

Download

memory/5472-50-0x00000000016E0000-0x0000000001A54000-memory.dmp

Download

memory/5932-21-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-9-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-26-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-27-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-28-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-29-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-24-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-32-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-30-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-33-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-23-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-22-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-19-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-37-0x0000000000A00000-0x0000000001308000-memory.dmp

Download

memory/5932-0-0x00007FFF8C3FF000-0x00007FFF8C400000-memory.dmp

Download

memory/5932-16-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-15-0x000001467F410000-0x000001467F424000-memory.dmp

Download

memory/5932-14-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-13-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-12-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-11-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-45-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-46-0x0000000000A00000-0x0000000001308000-memory.dmp

Download

memory/5932-47-0x000001467F430000-0x000001467F444000-memory.dmp

Download

memory/5932-10-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-25-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-8-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-7-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-6-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-54-0x000001467FE10000-0x000001467FED1000-memory.dmp

Download

memory/5932-55-0x000001467FE10000-0x000001467FED1000-memory.dmp

Download

memory/5932-5-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-3-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp

Download

memory/5932-59-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-4-0x000001467F3E0000-0x000001467F402000-memory.dmp

Download

memory/5932-62-0x000001467FE10000-0x000001467FED1000-memory.dmp

Download

memory/5932-70-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-100-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-74-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-77-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-80-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-83-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-85-0x00000146B00D0000-0x00000146B00E4000-memory.dmp

Download

memory/5932-87-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-90-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-91-0x000001467FA20000-0x000001467FA34000-memory.dmp

Download

memory/5932-94-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/5932-97-0x000001467FAE0000-0x000001467FC0F000-memory.dmp

Download

memory/6132-71-0x000001F846D10000-0x000001F846E0C000-memory.dmp

Download