Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/10/2026, 07:49
General
- Target da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff.exe
- Size 1002KB
- Sample261019-jnypgasthy
- SHA256 da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff
Malware Config
Extracted
-
formbook
-
4.1
-
ge11
-
treelightproperties.com
-
auditloglink.xyz
-
s9s9u.com
-
dadesports.online
-
naisongwativenga.online
-
horne.biz
-
smartroi.com.au
-
rbizns.com
-
q15v.cn
-
kfhm.com
-
ackexy.top
-
peaknesai.xyz
-
londi.tech
-
atriotbrotherspodcast.com
-
onogame1.com
-
dnczucbsai.com.cn
-
nssonai.com
-
rico808.com
-
betreasgames.ru
-
realgrab.ru
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff.exe"C:\Users\Admin\AppData\Local\Temp\da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff.exe"C:\Users\Admin\AppData\Local\Temp\da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hsgwslen.w3v.ps1
memory/1604-18-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/1604-0-0x0000000074722000-0x0000000074723000-memory.dmp
memory/1604-3-0x0000000004F00000-0x0000000004F92000-memory.dmp
memory/1604-4-0x0000000004E30000-0x0000000004E3A000-memory.dmp
memory/1604-5-0x0000000004FA0000-0x000000000503C000-memory.dmp
memory/1604-1-0x0000000000350000-0x0000000000450000-memory.dmp
memory/1604-7-0x00000000051F0000-0x000000000520E000-memory.dmp
memory/1604-8-0x0000000074722000-0x0000000074723000-memory.dmp
memory/1604-9-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/1604-10-0x0000000007350000-0x0000000007420000-memory.dmp
memory/1604-6-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/1604-2-0x00000000054C0000-0x0000000005A7A000-memory.dmp
memory/3016-39-0x0000000004950000-0x0000000004960000-memory.dmp
memory/3016-31-0x000000007F530000-0x000000007F540000-memory.dmp
memory/3016-16-0x0000000004FB0000-0x00000000055FA000-memory.dmp
memory/3016-49-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/3016-14-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/3016-13-0x00000000024A0000-0x00000000024D6000-memory.dmp
memory/3016-12-0x0000000074722000-0x0000000074723000-memory.dmp
memory/3016-21-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/3016-47-0x0000000004950000-0x0000000004960000-memory.dmp
memory/3016-20-0x0000000005600000-0x0000000005666000-memory.dmp
memory/3016-27-0x0000000005800000-0x0000000005B5B000-memory.dmp
memory/3016-30-0x0000000005D30000-0x0000000005D7C000-memory.dmp
memory/3016-29-0x0000000005CD0000-0x0000000005CEE000-memory.dmp
memory/3016-17-0x0000000004950000-0x0000000004960000-memory.dmp
memory/3016-32-0x0000000006EA0000-0x0000000006ED6000-memory.dmp
memory/3016-33-0x0000000071DC0000-0x0000000071E0C000-memory.dmp
memory/3016-19-0x0000000004F00000-0x0000000004F22000-memory.dmp
memory/3016-41-0x0000000006EE0000-0x0000000006F00000-memory.dmp
memory/3016-42-0x0000000006F00000-0x0000000006FA3000-memory.dmp
memory/3016-43-0x00000000076A0000-0x0000000007D1C000-memory.dmp
memory/3016-44-0x0000000007060000-0x000000000707A000-memory.dmp
memory/3016-45-0x00000000070D0000-0x00000000070DA000-memory.dmp
memory/3016-46-0x00000000072D0000-0x0000000007366000-memory.dmp
memory/4460-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4460-15-0x00000000018D0000-0x0000000001C44000-memory.dmp