Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
09/11/2026, 08:54
General
- Target 819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe
- Size 2.6MB
- Sample261109-kt2trawv2j
- SHA256 819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Drops file in Drivers directory 3 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe"C:\Users\Admin\AppData\Local\Temp\819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe"C:\Users\Admin\AppData\Local\Temp\819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe" --hs Suac12b657298a3f2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmptmt5pe.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmptmt5pe.tmp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\ProgramData\AMD\Link\AMD Link Service.exe"C:\ProgramData\AMD\Link\AMD Link Service.exe" --hs Suacd81f808a04042⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpmxddl3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpmxddl3.tmp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\drivers\nvfsflt64.sysC:\Windows\System32\drivers\nvfsflt64.sys1⤵
- Executes dropped EXE
-
C:\ProgramData\AMD\Link\AMD Link Service.exe"C:\ProgramData\AMD\Link\AMD Link Service.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
tmptmt5pe.tmp.exe
nvfsflt64.sys
memory/1480-18-0x00000000013F0000-0x0000000001400000-memory.dmp
memory/2384-24-0x0000000001BB0000-0x0000000001BC0000-memory.dmp
memory/3068-13-0x0000000000FA0000-0x0000000000FE7000-memory.dmp
memory/3068-14-0x00000000018C0000-0x0000000001C0A000-memory.dmp
memory/3068-32-0x0000000000FA0000-0x0000000000FE7000-memory.dmp
memory/3068-33-0x0000000000FA0000-0x0000000000FE7000-memory.dmp
memory/3912-5-0x0000000000E80000-0x0000000000E90000-memory.dmp
memory/5024-0-0x00000000011D0000-0x00000000011E0000-memory.dmp