formbook | 56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275

General

Target

Mv Maersk Kleven V949E_pdf.exe
Size

850KB
MD5

b9df17359c7c49389acb9d374464a780
SHA1

0edbf3c732a2afb16be8041e6a45133449b186eb
SHA256

56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275
SHA512

9c394b2d1e4973338686124ad48851571682cd0cd38f67e067498492c43ec60a8f839729bf88a62bc7b3b66c7f103776789ca7516b1fc5fc5c9cd980d26da27d

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1624-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1624-8-0x000000000041EBB0-mapping.dmp	formbook
behavioral1/memory/240-9-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

384 cmd.exe

pid	process
384	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeMv Maersk Kleven V949E_pdf.exeNAPSTAT.EXE

description	pid	process	target process
PID 1844 set thread context of 1624	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1624 set thread context of 1200	1624	Mv Maersk Kleven V949E_pdf.exe	Explorer.EXE
PID 240 set thread context of 1200	240	NAPSTAT.EXE	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeMv Maersk Kleven V949E_pdf.exeNAPSTAT.EXE

pid	process
1844	Mv Maersk Kleven V949E_pdf.exe
1844	Mv Maersk Kleven V949E_pdf.exe
1624	Mv Maersk Kleven V949E_pdf.exe
1624	Mv Maersk Kleven V949E_pdf.exe
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE
240	NAPSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeNAPSTAT.EXE

pid process

1624 Mv Maersk Kleven V949E_pdf.exe
1624 Mv Maersk Kleven V949E_pdf.exe
1624 Mv Maersk Kleven V949E_pdf.exe
240 NAPSTAT.EXE
240 NAPSTAT.EXE

pid	process
1624	Mv Maersk Kleven V949E_pdf.exe
1624	Mv Maersk Kleven V949E_pdf.exe
1624	Mv Maersk Kleven V949E_pdf.exe
240	NAPSTAT.EXE
240	NAPSTAT.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeMv Maersk Kleven V949E_pdf.exeNAPSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	1844	Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege	1624	Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege	240	NAPSTAT.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1200 Explorer.EXE
1200 Explorer.EXE
1200 Explorer.EXE
1200 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1200 Explorer.EXE
1200 Explorer.EXE
1200 Explorer.EXE
1200 Explorer.EXE

pid	process
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE

pid	process
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeExplorer.EXENAPSTAT.EXE

description	pid	process	target process
PID 1844 wrote to memory of 1572	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1572	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1572	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1572	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1624	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1624	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1624	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1624	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1624	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1624	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1844 wrote to memory of 1624	1844	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1200 wrote to memory of 240	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 240	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 240	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 240	1200	Explorer.EXE	NAPSTAT.EXE
PID 240 wrote to memory of 384	240	NAPSTAT.EXE	cmd.exe
PID 240 wrote to memory of 384	240	NAPSTAT.EXE	cmd.exe
PID 240 wrote to memory of 384	240	NAPSTAT.EXE	cmd.exe
PID 240 wrote to memory of 384	240	NAPSTAT.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"{path}"
3⤵
PID:1572

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
3⤵
- Deletes itself
PID:384

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-9-0x0000000000000000-mapping.dmp

Download
memory/240-10-0x0000000000690000-0x00000000006D6000-memory.dmp

Filesize
280KB

Download
memory/240-12-0x0000000001F80000-0x000000000205C000-memory.dmp

Filesize
880KB

Download
memory/384-11-0x0000000000000000-mapping.dmp

Download
memory/1624-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1624-8-0x000000000041EBB0-mapping.dmp

Download
memory/1844-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1844-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1844-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1844-6-0x0000000005150000-0x00000000051DF000-memory.dmp

Filesize
572KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads