Analysis

  • max time kernel
    148s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 06:59

General

  • Target

    Mv Maersk Kleven V949E_pdf.exe

  • Size

    847KB

  • MD5

    e47c0ab9cf929abce76d77ae7d634095

  • SHA1

    868807c4265bdfb8160cc9c7b062b8208a5ef93d

  • SHA256

    c94c6548dd723a5b6aac345f8aae65d4d8c6e86c3e86195c32616ab5dfa8cba9

  • SHA512

    fec7ea0143d2bb6c1a4003bbea1dffa1ef3e7458f3d9621d480a65c0fe1a651a150058052d69125cf77e76a7fd082930a7639a5fca4d171285c1e22ee422195d

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
        "{path}"
        3⤵
          PID:2212
        • C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
          "{path}"
          3⤵
            PID:2708
          • C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
            "{path}"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:2828
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:1176
          • C:\Windows\SysWOW64\autochk.exe
            "C:\Windows\SysWOW64\autochk.exe"
            2⤵
              PID:1364
            • C:\Windows\SysWOW64\autochk.exe
              "C:\Windows\SysWOW64\autochk.exe"
              2⤵
                PID:1172
              • C:\Windows\SysWOW64\autochk.exe
                "C:\Windows\SysWOW64\autochk.exe"
                2⤵
                  PID:1800
                • C:\Windows\SysWOW64\autochk.exe
                  "C:\Windows\SysWOW64\autochk.exe"
                  2⤵
                    PID:4020
                  • C:\Windows\SysWOW64\msdt.exe
                    "C:\Windows\SysWOW64\msdt.exe"
                    2⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4056
                    • C:\Windows\SysWOW64\cmd.exe
                      /c del "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
                      3⤵
                        PID:3452

                  Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/2828-11-0x0000000000400000-0x000000000042E000-memory.dmp
                    Filesize

                    184KB

                  • memory/2828-12-0x000000000041EBB0-mapping.dmp
                  • memory/3160-6-0x0000000004B80000-0x0000000004B81000-memory.dmp
                    Filesize

                    4KB

                  • memory/3160-2-0x00000000733D0000-0x0000000073ABE000-memory.dmp
                    Filesize

                    6.9MB

                  • memory/3160-7-0x0000000004B40000-0x0000000004B41000-memory.dmp
                    Filesize

                    4KB

                  • memory/3160-8-0x0000000004ED0000-0x0000000004EDE000-memory.dmp
                    Filesize

                    56KB

                  • memory/3160-9-0x0000000006FB0000-0x000000000703E000-memory.dmp
                    Filesize

                    568KB

                  • memory/3160-10-0x00000000070F0000-0x00000000070F1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3160-5-0x0000000005160000-0x0000000005161000-memory.dmp
                    Filesize

                    4KB

                  • memory/3160-3-0x0000000000240000-0x0000000000241000-memory.dmp
                    Filesize

                    4KB

                  • memory/3452-16-0x0000000000000000-mapping.dmp
                  • memory/4056-13-0x0000000000000000-mapping.dmp
                  • memory/4056-14-0x0000000001120000-0x0000000001293000-memory.dmp
                    Filesize

                    1.4MB

                  • memory/4056-15-0x0000000001120000-0x0000000001293000-memory.dmp
                    Filesize

                    1.4MB