Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 12:20
General
- Target BankDetails.exe
- Size 935KB
- Sample261110-phrxmaxw6r
- SHA256 209ccfc4aaa31f4f4d323a8eddbe33be8032d1f7ea3f69d35df03e8fae78f9b7
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BankDetails.exe"C:\Users\Admin\AppData\Local\Temp\BankDetails.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BankDetails.exe"C:\Users\Admin\AppData\Local\Temp\BankDetails.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BankDetails.exe"C:\Users\Admin\AppData\Local\Temp\BankDetails.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BankDetails.exe"C:\Users\Admin\AppData\Local\Temp\BankDetails.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3404-8-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/3404-10-0x0000000009370000-0x00000000093FA000-memory.dmp
memory/3404-2-0x0000000005AB0000-0x000000000606A000-memory.dmp
memory/3404-9-0x0000000009410000-0x00000000094AC000-memory.dmp
memory/3404-4-0x0000000005550000-0x000000000555A000-memory.dmp
memory/3404-5-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/3404-6-0x0000000008F90000-0x0000000008FAC000-memory.dmp
memory/3404-7-0x0000000074C02000-0x0000000074C03000-memory.dmp
memory/3404-1-0x0000000000A80000-0x0000000000B70000-memory.dmp
memory/3404-0-0x0000000074C02000-0x0000000074C03000-memory.dmp
memory/3404-3-0x0000000005590000-0x0000000005622000-memory.dmp
memory/3404-11-0x00000000099E0000-0x0000000009F0C000-memory.dmp
memory/3404-12-0x0000000009F10000-0x000000000A3DC000-memory.dmp
memory/3404-15-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/4856-14-0x0000000000D40000-0x0000000000D86000-memory.dmp
memory/4856-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4856-16-0x00000000013A0000-0x0000000001714000-memory.dmp
memory/4856-17-0x0000000000D40000-0x0000000000D86000-memory.dmp
memory/4856-18-0x0000000000D40000-0x0000000000D86000-memory.dmp