formbook | b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f

General

Target

Mv Maersk Kleven V949E_pdf.exe
Size

913KB
MD5

5281385b7bdbdbd17e1e08d1c0eb1a20
SHA1

f2a17bff838159ff075ceb276335e6235195f62a
SHA256

b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f
SHA512

d1e50d40531c85046b01f7df66024d716a6f5e25b3a099465183804f0657fcfcf963c1056cdd7d95c88b6b3ba509ffed19048298dfb28e682ed0cc89f146acf7

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2924-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2924-13-0x000000000041EBB0-mapping.dmp	formbook
behavioral2/memory/2392-21-0x0000000000180000-0x00000000001AE000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeMv Maersk Kleven V949E_pdf.exesystray.exe

description	pid	process	target process
PID 504 set thread context of 2924	504	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 2924 set thread context of 2876	2924	Mv Maersk Kleven V949E_pdf.exe	Explorer.EXE
PID 2392 set thread context of 2876	2392	systray.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exesystray.exe

pid	process
2924	Mv Maersk Kleven V949E_pdf.exe
2924	Mv Maersk Kleven V949E_pdf.exe
2924	Mv Maersk Kleven V949E_pdf.exe
2924	Mv Maersk Kleven V949E_pdf.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe
2392	systray.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exesystray.exe

pid process

2924 Mv Maersk Kleven V949E_pdf.exe
2924 Mv Maersk Kleven V949E_pdf.exe
2924 Mv Maersk Kleven V949E_pdf.exe
2392 systray.exe
2392 systray.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exesystray.exe

description pid process

Token: SeDebugPrivilege 2924 Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege 2392 systray.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2876 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2924	Mv Maersk Kleven V949E_pdf.exe
Token: SeDebugPrivilege	2392	systray.exe

pid	process
2876	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Mv Maersk Kleven V949E_pdf.exeExplorer.EXEsystray.exe

description	pid	process	target process
PID 504 wrote to memory of 2924	504	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 504 wrote to memory of 2924	504	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 504 wrote to memory of 2924	504	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 504 wrote to memory of 2924	504	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 504 wrote to memory of 2924	504	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 504 wrote to memory of 2924	504	Mv Maersk Kleven V949E_pdf.exe	Mv Maersk Kleven V949E_pdf.exe
PID 2876 wrote to memory of 2392	2876	Explorer.EXE	systray.exe
PID 2876 wrote to memory of 2392	2876	Explorer.EXE	systray.exe
PID 2876 wrote to memory of 2392	2876	Explorer.EXE	systray.exe
PID 2392 wrote to memory of 2484	2392	systray.exe	cmd.exe
PID 2392 wrote to memory of 2484	2392	systray.exe	cmd.exe
PID 2392 wrote to memory of 2484	2392	systray.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:504

C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"
3⤵
PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-9-0x0000000005890000-0x000000000589E000-memory.dmp

Filesize
56KB

Download
memory/504-11-0x0000000007B00000-0x0000000007B01000-memory.dmp

Filesize
4KB

Download
memory/504-5-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/504-6-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/504-7-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/504-8-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/504-3-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/504-2-0x0000000073D40000-0x000000007442E000-memory.dmp

Filesize
6.9MB

Download
memory/504-10-0x0000000007420000-0x000000000747C000-memory.dmp

Filesize
368KB

Download
memory/2392-23-0x0000000000DA0000-0x0000000000E33000-memory.dmp

Filesize
588KB

Download
memory/2392-22-0x0000000000F40000-0x0000000001260000-memory.dmp

Filesize
3.1MB

Download
memory/2392-21-0x0000000000180000-0x00000000001AE000-memory.dmp

Filesize
184KB

Download
memory/2392-20-0x0000000001260000-0x0000000001266000-memory.dmp

Filesize
24KB

Download
memory/2392-18-0x0000000000000000-mapping.dmp

Download
memory/2484-19-0x0000000000000000-mapping.dmp

Download
memory/2876-17-0x0000000002A40000-0x0000000002B37000-memory.dmp

Filesize
988KB

Download
memory/2876-24-0x0000000006270000-0x000000000637B000-memory.dmp

Filesize
1.0MB

Download
memory/2924-15-0x0000000000F30000-0x0000000001250000-memory.dmp

Filesize
3.1MB

Download
memory/2924-16-0x00000000013A0000-0x00000000013B4000-memory.dmp

Filesize
80KB

Download
memory/2924-13-0x000000000041EBB0-mapping.dmp

Download
memory/2924-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads