formbook | 56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275

General

Target

Mv Maersk Kleven V949E_pdf.exe
Size

850KB
MD5

b9df17359c7c49389acb9d374464a780
SHA1

0edbf3c732a2afb16be8041e6a45133449b186eb
SHA256

56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275
SHA512

9c394b2d1e4973338686124ad48851571682cd0cd38f67e067498492c43ec60a8f839729bf88a62bc7b3b66c7f103776789ca7516b1fc5fc5c9cd980d26da27d

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3304-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3304-12-0x000000000041EBB0-mapping.dmp	formbook
behavioral2/memory/4244-13-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeMv Maersk Kleven V949E_pdf.exemsiexec.exe

description	pid	process	target process
PID 4688 set thread context of 3304	4688	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 3304 set thread context of 2896	3304	Mv Maersk Kleven V949E_pdf.exe	Explorer.EXE
PID 4244 set thread context of 2896	4244	msiexec.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exemsiexec.exe

pid	process
3304	Mv Maersk Kleven V949E_pdf.exe
3304	Mv Maersk Kleven V949E_pdf.exe
3304	Mv Maersk Kleven V949E_pdf.exe
3304	Mv Maersk Kleven V949E_pdf.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exemsiexec.exe

pid process

3304 Mv Maersk Kleven V949E_pdf.exe
3304 Mv Maersk Kleven V949E_pdf.exe
3304 Mv Maersk Kleven V949E_pdf.exe
4244 msiexec.exe
4244 msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 3304 Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege 4244 msiexec.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2896 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3304	Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege	4244	msiexec.exe

pid	process
2896	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 4688 wrote to memory of 3304	4688	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 4688 wrote to memory of 3304	4688	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 4688 wrote to memory of 3304	4688	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 4688 wrote to memory of 3304	4688	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 4688 wrote to memory of 3304	4688	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 4688 wrote to memory of 3304	4688	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 2896 wrote to memory of 4244	2896	Explorer.EXE	msiexec.exe
PID 2896 wrote to memory of 4244	2896	Explorer.EXE	msiexec.exe
PID 2896 wrote to memory of 4244	2896	Explorer.EXE	msiexec.exe
PID 4244 wrote to memory of 1864	4244	msiexec.exe	cmd.exe
PID 4244 wrote to memory of 1864	4244	msiexec.exe	cmd.exe
PID 4244 wrote to memory of 1864	4244	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
    3⤵
    PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-16-0x0000000000000000-mapping.dmp

Download
memory/3304-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3304-12-0x000000000041EBB0-mapping.dmp

Download
memory/4244-17-0x0000000005410000-0x0000000005541000-memory.dmp

Filesize
1.2MB

Download
memory/4244-15-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/4244-14-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/4244-13-0x0000000000000000-mapping.dmp

Download
memory/4688-6-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/4688-10-0x0000000007810000-0x0000000007811000-memory.dmp

Filesize
4KB

Download
memory/4688-9-0x00000000076E0000-0x000000000776F000-memory.dmp

Filesize
572KB

Download
memory/4688-8-0x0000000005610000-0x000000000561E000-memory.dmp

Filesize
56KB

Download
memory/4688-7-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/4688-2-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/4688-5-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/4688-3-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads