Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 11:48
General
- Target 5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be.exe
- Size 825KB
- Sample261014-nyjerafh66
- SHA256 5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be.exe"C:\Users\Admin\AppData\Local\Temp\5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be.exe"C:\Users\Admin\AppData\Local\Temp\5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be.exe"C:\Users\Admin\AppData\Local\Temp\5c76fecfe6957343e6a723329a53e7eac03e7b9cf081aad95e033684bb79e3be.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 2283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2808 -ip 28081⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_mxxm0aur.gi5.psm1
memory/2808-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2808-20-0x00000000010D0000-0x0000000001444000-memory.dmp
memory/2808-14-0x0000000000AE0000-0x0000000000B26000-memory.dmp
memory/4704-37-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/4704-35-0x0000000006480000-0x00000000064A0000-memory.dmp
memory/4704-47-0x00000000744E0000-0x0000000074C9C000-memory.dmp
memory/4704-44-0x00000000744E0000-0x0000000074C9C000-memory.dmp
memory/4704-45-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/4704-43-0x00000000744F2000-0x00000000744F3000-memory.dmp
memory/4704-42-0x0000000007460000-0x00000000074F6000-memory.dmp
memory/4704-41-0x0000000007260000-0x000000000726A000-memory.dmp
memory/4704-40-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/4704-39-0x0000000007830000-0x0000000007EAC000-memory.dmp
memory/4704-38-0x0000000006EB0000-0x0000000006F53000-memory.dmp
memory/4704-15-0x0000000002640000-0x0000000002676000-memory.dmp
memory/4704-16-0x00000000744F2000-0x00000000744F3000-memory.dmp
memory/4704-17-0x00000000744E0000-0x0000000074C9C000-memory.dmp
memory/4704-26-0x0000000005920000-0x0000000005986000-memory.dmp
memory/4704-36-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/4704-19-0x0000000005260000-0x00000000058AA000-memory.dmp
memory/4704-22-0x00000000050B0000-0x00000000050D2000-memory.dmp
memory/4704-32-0x0000000070D30000-0x0000000070D7C000-memory.dmp
memory/4704-18-0x00000000744E0000-0x0000000074C9C000-memory.dmp
memory/4704-31-0x0000000006E70000-0x0000000006EA6000-memory.dmp
memory/4704-27-0x0000000005990000-0x0000000005CEB000-memory.dmp
memory/4704-28-0x0000000005E80000-0x0000000005E9E000-memory.dmp
memory/4704-29-0x00000000063E0000-0x000000000642C000-memory.dmp
memory/4704-30-0x000000007F9D0000-0x000000007F9E0000-memory.dmp
memory/4704-25-0x00000000058B0000-0x0000000005916000-memory.dmp
memory/5080-10-0x00000000091F0000-0x000000000927A000-memory.dmp
memory/5080-7-0x00000000744F2000-0x00000000744F3000-memory.dmp
memory/5080-21-0x00000000744E0000-0x0000000074C9C000-memory.dmp
memory/5080-0-0x00000000744F2000-0x00000000744F3000-memory.dmp
memory/5080-2-0x00000000056E0000-0x0000000005C9A000-memory.dmp
memory/5080-5-0x00000000744E0000-0x0000000074C9C000-memory.dmp
memory/5080-11-0x0000000009860000-0x0000000009D8C000-memory.dmp
memory/5080-12-0x0000000009D90000-0x000000000A25C000-memory.dmp
memory/5080-1-0x00000000005F0000-0x00000000006C4000-memory.dmp
memory/5080-4-0x00000000050B0000-0x00000000050BA000-memory.dmp
memory/5080-9-0x0000000009290000-0x000000000932C000-memory.dmp
memory/5080-8-0x00000000744E0000-0x0000000074C9C000-memory.dmp
memory/5080-3-0x0000000005120000-0x00000000051B2000-memory.dmp
memory/5080-6-0x00000000056A0000-0x00000000056B0000-memory.dmp