Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/10/2026, 14:09
General
- Target CDS Entry Document - 6GB235976624000-SEAE26J509548 WOTHMPHMP0000000221678 B1 (EXD - 2300).exe
- Size 805KB
- Sample261020-rf77yaex2n
- SHA256 928c12ed72ab7f63a494b3ec7f0c4b5fb54a2aa2f9709f945f5e411767f2d582
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CDS Entry Document - 6GB235976624000-SEAE26J509548 WOTHMPHMP0000000221678 B1 (EXD - 2300).exe"C:\Users\Admin\AppData\Local\Temp\CDS Entry Document - 6GB235976624000-SEAE26J509548 WOTHMPHMP0000000221678 B1 (EXD - 2300).exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\CDS Entry Document - 6GB235976624000-SEAE26J509548 WOTHMPHMP0000000221678 B1 (EXD - 2300).exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\CDS Entry Document - 6GB235976624000-SEAE26J509548 WOTHMPHMP0000000221678 B1 (EXD - 2300).exe"C:\Users\Admin\AppData\Local\Temp\CDS Entry Document - 6GB235976624000-SEAE26J509548 WOTHMPHMP0000000221678 B1 (EXD - 2300).exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_dpnn0nu5.rmd.ps1
memory/1532-44-0x0000000006FE0000-0x0000000007083000-memory.dmp
memory/1532-46-0x0000000007110000-0x000000000712A000-memory.dmp
memory/1532-53-0x0000000007430000-0x0000000007438000-memory.dmp
memory/1532-52-0x0000000007450000-0x000000000746A000-memory.dmp
memory/1532-51-0x0000000007360000-0x0000000007374000-memory.dmp
memory/1532-50-0x0000000007350000-0x000000000735E000-memory.dmp
memory/1532-49-0x0000000007320000-0x0000000007331000-memory.dmp
memory/1532-48-0x0000000007390000-0x0000000007426000-memory.dmp
memory/1532-47-0x0000000007180000-0x000000000718A000-memory.dmp
memory/1532-30-0x0000000005DF0000-0x0000000005E0E000-memory.dmp
memory/1532-45-0x0000000007760000-0x0000000007DDA000-memory.dmp
memory/1532-34-0x0000000070EB0000-0x0000000070EFC000-memory.dmp
memory/1532-16-0x00000000049A0000-0x00000000049B0000-memory.dmp
memory/1532-14-0x0000000004840000-0x0000000004876000-memory.dmp
memory/1532-15-0x00000000049A0000-0x00000000049B0000-memory.dmp
memory/1532-17-0x0000000004FE0000-0x0000000005608000-memory.dmp
memory/1532-43-0x00000000049A0000-0x00000000049B0000-memory.dmp
memory/1532-19-0x0000000004E40000-0x0000000004E62000-memory.dmp
memory/1532-21-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/1532-20-0x0000000005610000-0x0000000005676000-memory.dmp
memory/1532-42-0x0000000006350000-0x000000000636E000-memory.dmp
memory/1532-27-0x0000000005820000-0x0000000005B74000-memory.dmp
memory/1532-33-0x0000000006370000-0x00000000063A2000-memory.dmp
memory/1532-31-0x00000000063D0000-0x000000000641C000-memory.dmp
memory/1532-32-0x000000007F910000-0x000000007F920000-memory.dmp
memory/2520-12-0x0000000000FE0000-0x0000000001027000-memory.dmp
memory/2520-57-0x0000000000FE0000-0x0000000001027000-memory.dmp
memory/2520-18-0x00000000014D0000-0x000000000181A000-memory.dmp
memory/2520-11-0x0000000000400000-0x0000000000447000-memory.dmp
memory/2520-54-0x0000000000FE0000-0x0000000001027000-memory.dmp
memory/3192-8-0x0000000008090000-0x000000000811A000-memory.dmp
memory/3192-10-0x0000000008B80000-0x000000000904C000-memory.dmp
memory/3192-1-0x00000000050E0000-0x0000000005684000-memory.dmp
memory/3192-7-0x0000000004CC0000-0x0000000004CD0000-memory.dmp
memory/3192-9-0x0000000008650000-0x0000000008B7C000-memory.dmp
memory/3192-6-0x0000000004D60000-0x0000000004D76000-memory.dmp
memory/3192-5-0x0000000004D70000-0x0000000004E0C000-memory.dmp
memory/3192-4-0x0000000004AB0000-0x0000000004ABA000-memory.dmp
memory/3192-3-0x0000000004CC0000-0x0000000004CD0000-memory.dmp
memory/3192-0-0x0000000000010000-0x00000000000E0000-memory.dmp
memory/3192-2-0x0000000004B30000-0x0000000004BC2000-memory.dmp