Analysis
- user interaction
yes - max time kernel
149s - max time network
144s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
29/10/2026, 23:05
General
- Target 81c81ed0c8aa166aeb5da40c7ebc105f6d51824b1d116d9cd548e0883b8ab92e.exe
- Size 804KB
- Sample261029-22746sty7n
- SHA256 81c81ed0c8aa166aeb5da40c7ebc105f6d51824b1d116d9cd548e0883b8ab92e
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c81ed0c8aa166aeb5da40c7ebc105f6d51824b1d116d9cd548e0883b8ab92e.exe"C:\Users\Admin\AppData\Local\Temp\81c81ed0c8aa166aeb5da40c7ebc105f6d51824b1d116d9cd548e0883b8ab92e.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\81c81ed0c8aa166aeb5da40c7ebc105f6d51824b1d116d9cd548e0883b8ab92e.exe"C:\Users\Admin\AppData\Local\Temp\81c81ed0c8aa166aeb5da40c7ebc105f6d51824b1d116d9cd548e0883b8ab92e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 1963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2516 -ip 25161⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2516-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2516-15-0x0000000000E30000-0x0000000000E76000-memory.dmp
memory/2516-14-0x0000000001470000-0x00000000017BC000-memory.dmp
memory/2516-13-0x0000000000E30000-0x0000000000E76000-memory.dmp
memory/3088-6-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/3088-5-0x0000000005CB0000-0x0000000005CC6000-memory.dmp
memory/3088-0-0x0000000000F50000-0x0000000001020000-memory.dmp
memory/3088-7-0x0000000008270000-0x000000000830C000-memory.dmp
memory/3088-8-0x0000000008310000-0x000000000839A000-memory.dmp
memory/3088-9-0x00000000088D0000-0x0000000008DFC000-memory.dmp
memory/3088-10-0x0000000008E00000-0x00000000092CC000-memory.dmp
memory/3088-4-0x0000000005A20000-0x0000000005A2A000-memory.dmp
memory/3088-3-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/3088-2-0x0000000005A70000-0x0000000005B02000-memory.dmp
memory/3088-1-0x0000000005F80000-0x0000000006526000-memory.dmp