formbook | a078d966a3ac5a7ac639b01ba4d3230c7554d7d75e9e7f59dc35b623aec8dbda

General

Target

Mv Maersk Kleven V949E_pdf.exe
Size

958KB
MD5

b86abf15be6a1c7027e7a89ea3d821ca
SHA1

3b1bc94e7565aaf7cbe293dba32fca871ecf704d
SHA256

a078d966a3ac5a7ac639b01ba4d3230c7554d7d75e9e7f59dc35b623aec8dbda
SHA512

45447d8f3f87f76f5813698ed08b55c72de283ba367382a73599dcc27773e82ee9ff4e9edc339c0a74fc5e1dae998d6f16e125a7ad6fd9824d0bc72d7d5d4419

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1224-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1224-8-0x000000000041EBB0-mapping.dmp	formbook
behavioral1/memory/556-9-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

820 cmd.exe

pid	process
820	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeMv Maersk Kleven V949E_pdf.execmd.exe

description	pid	process	target process
PID 932 set thread context of 1224	932	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1224 set thread context of 1276	1224	Mv Maersk Kleven V949E_pdf.exe	Explorer.EXE
PID 556 set thread context of 1276	556	cmd.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.execmd.exe

pid	process
1224	Mv Maersk Kleven V949E_pdf.exe
1224	Mv Maersk Kleven V949E_pdf.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe
556	cmd.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.execmd.exe

pid process

1224 Mv Maersk Kleven V949E_pdf.exe
1224 Mv Maersk Kleven V949E_pdf.exe
1224 Mv Maersk Kleven V949E_pdf.exe
556 cmd.exe
556 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.execmd.exe

description pid process

Token: SeDebugPrivilege 1224 Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege 556 cmd.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1224	Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege	556	cmd.exe

pid	process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 932 wrote to memory of 1224	932	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 932 wrote to memory of 1224	932	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 932 wrote to memory of 1224	932	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 932 wrote to memory of 1224	932	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 932 wrote to memory of 1224	932	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 932 wrote to memory of 1224	932	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 932 wrote to memory of 1224	932	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1276 wrote to memory of 556	1276	Explorer.EXE	cmd.exe
PID 1276 wrote to memory of 556	1276	Explorer.EXE	cmd.exe
PID 1276 wrote to memory of 556	1276	Explorer.EXE	cmd.exe
PID 1276 wrote to memory of 556	1276	Explorer.EXE	cmd.exe
PID 556 wrote to memory of 820	556	cmd.exe	cmd.exe
PID 556 wrote to memory of 820	556	cmd.exe	cmd.exe
PID 556 wrote to memory of 820	556	cmd.exe	cmd.exe
PID 556 wrote to memory of 820	556	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:932

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1564

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1588

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1708

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1688

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1676

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:996

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:268

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1016

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
3⤵
- Deletes itself
PID:820

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-9-0x0000000000000000-mapping.dmp

Download
memory/556-10-0x000000004A5C0000-0x000000004A60C000-memory.dmp

Filesize
304KB

Download
memory/556-12-0x0000000003170000-0x0000000003246000-memory.dmp

Filesize
856KB

Download
memory/820-11-0x0000000000000000-mapping.dmp

Download
memory/932-2-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/932-3-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/932-5-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/932-6-0x0000000004300000-0x000000000434C000-memory.dmp

Filesize
304KB

Download
memory/1224-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1224-8-0x000000000041EBB0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads