Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 16:18
General
- Target c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270.exe
- Size 1.1MB
- Sample261014-tr7rnafw8w
- SHA256 c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270.exe"C:\Users\Admin\AppData\Local\Temp\c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270.exe"C:\Users\Admin\AppData\Local\Temp\c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 2283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3048 -ip 30481⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3048-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3048-17-0x0000000000E30000-0x0000000000E76000-memory.dmp
memory/3048-16-0x0000000001350000-0x00000000016C4000-memory.dmp
memory/3048-14-0x0000000000E30000-0x0000000000E76000-memory.dmp
memory/4392-8-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/4392-11-0x000000000C550000-0x000000000CA7C000-memory.dmp
memory/4392-6-0x000000000BAB0000-0x000000000BAC6000-memory.dmp
memory/4392-7-0x00000000747F2000-0x00000000747F3000-memory.dmp
memory/4392-0-0x00000000747F2000-0x00000000747F3000-memory.dmp
memory/4392-9-0x000000000BF80000-0x000000000C01C000-memory.dmp
memory/4392-10-0x000000000BEE0000-0x000000000BF6A000-memory.dmp
memory/4392-5-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/4392-12-0x000000000CA80000-0x000000000CF4C000-memory.dmp
memory/4392-4-0x00000000054B0000-0x00000000054BA000-memory.dmp
memory/4392-3-0x0000000007FA0000-0x0000000008032000-memory.dmp
memory/4392-15-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/4392-2-0x00000000084C0000-0x0000000008A7A000-memory.dmp
memory/4392-1-0x0000000000F60000-0x0000000001074000-memory.dmp