formbook | b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f

General

Target

Mv Maersk Kleven V949E_pdf.exe
Size

913KB
MD5

5281385b7bdbdbd17e1e08d1c0eb1a20
SHA1

f2a17bff838159ff075ceb276335e6235195f62a
SHA256

b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f
SHA512

d1e50d40531c85046b01f7df66024d716a6f5e25b3a099465183804f0657fcfcf963c1056cdd7d95c88b6b3ba509ffed19048298dfb28e682ed0cc89f146acf7

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1524-8-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1524-9-0x000000000041EBB0-mapping.dmp	formbook
behavioral1/memory/1000-17-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1088 cmd.exe

pid	process
1088	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeMv Maersk Kleven V949E_pdf.execontrol.exe

description	pid	process	target process
PID 776 set thread context of 1524	776	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1524 set thread context of 1272	1524	Mv Maersk Kleven V949E_pdf.exe	Explorer.EXE
PID 1000 set thread context of 1272	1000	control.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.execontrol.exe

pid	process
1524	Mv Maersk Kleven V949E_pdf.exe
1524	Mv Maersk Kleven V949E_pdf.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe
1000	control.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.execontrol.exe

pid process

1524 Mv Maersk Kleven V949E_pdf.exe
1524 Mv Maersk Kleven V949E_pdf.exe
1524 Mv Maersk Kleven V949E_pdf.exe
1000 control.exe
1000 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.execontrol.exe

description pid process

Token: SeDebugPrivilege 1524 Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege 1000 control.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE
1272 Explorer.EXE
1272 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE
1272 Explorer.EXE
1272 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1524	Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege	1000	control.exe

pid	process
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE

pid	process
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 776 wrote to memory of 1524	776	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 776 wrote to memory of 1524	776	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 776 wrote to memory of 1524	776	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 776 wrote to memory of 1524	776	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 776 wrote to memory of 1524	776	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 776 wrote to memory of 1524	776	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 776 wrote to memory of 1524	776	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 1272 wrote to memory of 1000	1272	Explorer.EXE	control.exe
PID 1272 wrote to memory of 1000	1272	Explorer.EXE	control.exe
PID 1272 wrote to memory of 1000	1272	Explorer.EXE	control.exe
PID 1272 wrote to memory of 1000	1272	Explorer.EXE	control.exe
PID 1000 wrote to memory of 1088	1000	control.exe	cmd.exe
PID 1000 wrote to memory of 1088	1000	control.exe	cmd.exe
PID 1000 wrote to memory of 1088	1000	control.exe	cmd.exe
PID 1000 wrote to memory of 1088	1000	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
3⤵
- Deletes itself
PID:1088

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-2-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/776-3-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/776-5-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/776-6-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/776-7-0x0000000005210000-0x000000000526C000-memory.dmp

Filesize
368KB

Download
memory/1000-16-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download
memory/1000-14-0x0000000000000000-mapping.dmp

Download
memory/1000-15-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1000-17-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/1000-19-0x0000000001DA0000-0x00000000020A3000-memory.dmp

Filesize
3.0MB

Download
memory/1000-20-0x0000000002150000-0x00000000021E3000-memory.dmp

Filesize
588KB

Download
memory/1088-18-0x0000000000000000-mapping.dmp

Download
memory/1272-13-0x0000000006CE0000-0x0000000006E7D000-memory.dmp

Filesize
1.6MB

Download
memory/1524-9-0x000000000041EBB0-mapping.dmp

Download
memory/1524-11-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1524-12-0x00000000003A0000-0x00000000003B4000-memory.dmp

Filesize
80KB

Download
memory/1524-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads