formbook | a078d966a3ac5a7ac639b01ba4d3230c7554d7d75e9e7f59dc35b623aec8dbda

General

Target

Mv Maersk Kleven V949E_pdf.exe
Size

958KB
MD5

b86abf15be6a1c7027e7a89ea3d821ca
SHA1

3b1bc94e7565aaf7cbe293dba32fca871ecf704d
SHA256

a078d966a3ac5a7ac639b01ba4d3230c7554d7d75e9e7f59dc35b623aec8dbda
SHA512

45447d8f3f87f76f5813698ed08b55c72de283ba367382a73599dcc27773e82ee9ff4e9edc339c0a74fc5e1dae998d6f16e125a7ad6fd9824d0bc72d7d5d4419

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/192-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/192-12-0x000000000041EBB0-mapping.dmp	formbook
behavioral2/memory/644-13-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeMv Maersk Kleven V949E_pdf.exesystray.exe

description	pid	process	target process
PID 864 set thread context of 192	864	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 192 set thread context of 3048	192	Mv Maersk Kleven V949E_pdf.exe	Explorer.EXE
PID 644 set thread context of 3048	644	systray.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exesystray.exe

pid	process
192	Mv Maersk Kleven V949E_pdf.exe
192	Mv Maersk Kleven V949E_pdf.exe
192	Mv Maersk Kleven V949E_pdf.exe
192	Mv Maersk Kleven V949E_pdf.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe
644	systray.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exesystray.exe

pid process

192 Mv Maersk Kleven V949E_pdf.exe
192 Mv Maersk Kleven V949E_pdf.exe
192 Mv Maersk Kleven V949E_pdf.exe
644 systray.exe
644 systray.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exesystray.exe

description pid process

Token: SeDebugPrivilege 192 Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege 644 systray.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3048 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	192	Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege	644	systray.exe

pid	process
3048	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeExplorer.EXEsystray.exe

description	pid	process	target process
PID 864 wrote to memory of 192	864	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 864 wrote to memory of 192	864	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 864 wrote to memory of 192	864	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 864 wrote to memory of 192	864	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 864 wrote to memory of 192	864	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 864 wrote to memory of 192	864	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 3048 wrote to memory of 644	3048	Explorer.EXE	systray.exe
PID 3048 wrote to memory of 644	3048	Explorer.EXE	systray.exe
PID 3048 wrote to memory of 644	3048	Explorer.EXE	systray.exe
PID 644 wrote to memory of 2336	644	systray.exe	cmd.exe
PID 644 wrote to memory of 2336	644	systray.exe	cmd.exe
PID 644 wrote to memory of 2336	644	systray.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:192

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
3⤵
PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/192-12-0x000000000041EBB0-mapping.dmp

Download
memory/644-17-0x0000000006220000-0x0000000006359000-memory.dmp

Filesize
1.2MB

Download
memory/644-15-0x0000000000F40000-0x0000000000F46000-memory.dmp

Filesize
24KB

Download
memory/644-14-0x0000000000F40000-0x0000000000F46000-memory.dmp

Filesize
24KB

Download
memory/644-13-0x0000000000000000-mapping.dmp

Download
memory/864-6-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/864-10-0x00000000063E0000-0x00000000063E1000-memory.dmp

Filesize
4KB

Download
memory/864-9-0x00000000062F0000-0x000000000633C000-memory.dmp

Filesize
304KB

Download
memory/864-8-0x0000000005690000-0x000000000569E000-memory.dmp

Filesize
56KB

Download
memory/864-7-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/864-2-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/864-5-0x0000000005B60000-0x0000000005B61000-memory.dmp

Filesize
4KB

Download
memory/864-3-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2336-16-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads