| File name: | Ck8kQqXkroE4Vc1.exe |
| Full analysis: | https://app.any.run/tasks/3b7b73ab-3c6e-4884-af3c-cbf9c6766797 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | April 29, 2025, 13:05:49 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 40E0B3CBB5FF5C75BE23297B12053AA0 |
| SHA1: | 8DDEDBB03E47781E7D05AA2B6E42BA4E4505E2C4 |
| SHA256: | 035CF98A4ED96281EC028EC33C8A15C578E3157F9A1F8E90E95DDBC6204ADA29 |
| SSDEEP: | 24576:wkrv8gkkrvefE5F93v5IKLns43A5PThWczAKPw8zC1PTM8QJRfHsxqoevOyJ0NI+:wkrv8gkkrvefE5F93v5IKLns4Q5PThWr |
MALICIOUS
Uses Task Scheduler to run other applications
- Ck8kQqXkroE4Vc1.exe (PID: 2092)
FORMBOOK has been detected
- cmstp.exe (PID: 2108)
FORMBOOK has been detected (YARA)
- cmstp.exe (PID: 2108)
SUSPICIOUS
Executable content was dropped or overwritten
- Ck8kQqXkroE4Vc1.exe (PID: 2092)
Reads security settings of Internet Explorer
- Ck8kQqXkroE4Vc1.exe (PID: 2092)
The process executes VB scripts
- Ck8kQqXkroE4Vc1.exe (PID: 2092)
Deletes system .NET executable
- cmd.exe (PID: 1116)
Starts CMD.EXE for commands execution
- cmstp.exe (PID: 2108)
INFO
Creates files or folders in the user directory
- Ck8kQqXkroE4Vc1.exe (PID: 2092)
Process checks computer location settings
- Ck8kQqXkroE4Vc1.exe (PID: 2092)
Checks supported languages
- Ck8kQqXkroE4Vc1.exe (PID: 2092)
- vbc.exe (PID: 3272)
Create files in a temporary directory
- Ck8kQqXkroE4Vc1.exe (PID: 2092)
Reads the computer name
- vbc.exe (PID: 3272)
Manual execution by a user
- autochk.exe (PID: 4120)
- cmstp.exe (PID: 2108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(2108) cmstp.exe
C2www.gsp657.top/hi13/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
f-end
Decoy C2 (64)olidspot.shop
aise-your-voice.sbs
9ydygorig3l7z.xyz
netuzio.xyz
erspacehealthandwellness.info
hbnzk.cfd
uklor.shop
tudiofoti.pro
onety.skin
iralavinc.online
teelpath.shop
w-yudfjp.shop
betka.xyz
lx2cbhe5vee0e1.xyz
ndotoverf.pro
loud-sevice.click
enckubs.shop
anpack.shop
nity-3d-development.dev
iaolento12.sbs
xectgroup.net
avakey.shop
kfast.store
ayeewenvqzqm.top
66xq2.top
cvaultshielded.live
5zbm0.cfd
g1wszulqv7lc.xyz
rog.top
xplosion-proof.lat
aysec.net
999game.website
3a4p8gq8bojwn.xyz
x92q.top
akextow.net
t775.top
873013.xyz
tu1x120.top
9882aa1216.autos
ayarwarna21.live
ardengoal.net
8ln62.cfd
elvetvoiceskiresorts.website
kpqh.town
njjwh.info
movps.net
pb79kasy.vip
ellbar.shop
inktrim.xyz
hagrinleemotooltechus.shop
olayl
tp-batik77-1.vip
looring-services329769.sbs
130t.xyz
9gi02.cfd
elayrunway.shop
phones-br.sbs
aser-skin-treatment-95250.bond
ry-prodentims.shop
rtelegans.art
01411.club
it4n1ar4t0k7o0.xyz
igitalmilanolegacy.shop
ompanion.bio
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:04:29 00:49:31+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 737280 |
| InitializedDataSize: | 10752 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5f7a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | Engaging word puzzle game with multiple challenge levels and vocabulary enhancement |
| CompanyName: | Phantom Dimension Software |
| FileDescription: | LexiQuest Deluxe |
| FileVersion: | 1.0.0.0 |
| InternalName: | uDEo.exe |
| LegalCopyright: | Copyright © Phantom Dimension Software 2025 |
| LegalTrademarks: | LexiQuest™ |
| OriginalFileName: | uDEo.exe |
| ProductName: | LexiQuest Deluxe |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.3.0 |
Total processes
144
Monitored processes
9
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1116 | /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" | C:\Windows\SysWOW64\cmd.exe | — | cmstp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1852 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2092 | "C:\Users\admin\AppData\Local\Temp\Ck8kQqXkroE4Vc1.exe" | C:\Users\admin\AppData\Local\Temp\Ck8kQqXkroE4Vc1.exe | explorer.exe | ||||||||||||
User: admin Company: Phantom Dimension Software Integrity Level: MEDIUM Description: LexiQuest Deluxe Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2108 | "C:\Windows\SysWOW64\cmstp.exe" | C:\Windows\SysWOW64\cmstp.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Connection Manager Profile Installer Version: 7.2.19041.1 (WinBuild.160101.0800) Modules
Formbook(PID) Process(2108) cmstp.exe C2www.gsp657.top/hi13/ Strings (79)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start f-end Decoy C2 (64)olidspot.shop aise-your-voice.sbs 9ydygorig3l7z.xyz netuzio.xyz erspacehealthandwellness.info hbnzk.cfd uklor.shop tudiofoti.pro onety.skin iralavinc.online teelpath.shop w-yudfjp.shop betka.xyz lx2cbhe5vee0e1.xyz ndotoverf.pro loud-sevice.click enckubs.shop anpack.shop nity-3d-development.dev iaolento12.sbs xectgroup.net avakey.shop kfast.store ayeewenvqzqm.top 66xq2.top cvaultshielded.live 5zbm0.cfd g1wszulqv7lc.xyz rog.top xplosion-proof.lat aysec.net 999game.website 3a4p8gq8bojwn.xyz x92q.top akextow.net t775.top 873013.xyz tu1x120.top 9882aa1216.autos ayarwarna21.live ardengoal.net 8ln62.cfd elvetvoiceskiresorts.website kpqh.town njjwh.info movps.net pb79kasy.vip ellbar.shop inktrim.xyz hagrinleemotooltechus.shop olayl tp-batik77-1.vip looring-services329769.sbs 130t.xyz 9gi02.cfd elayrunway.shop phones-br.sbs aser-skin-treatment-95250.bond ry-prodentims.shop rtelegans.art 01411.club it4n1ar4t0k7o0.xyz igitalmilanolegacy.shop ompanion.bio | |||||||||||||||
| 3272 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | — | Ck8kQqXkroE4Vc1.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 14.8.9037.0 Modules
| |||||||||||||||
| 4120 | "C:\Windows\SysWOW64\autochk.exe" | C:\Windows\SysWOW64\autochk.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Auto Check Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5400 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5968 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7152 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zZBPsxOyA" /XML "C:\Users\admin\AppData\Local\Temp\tmpF733.tmp" | C:\Windows\SysWOW64\schtasks.exe | — | Ck8kQqXkroE4Vc1.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
513
Read events
513
Write events
0
Delete events
0
Modification events
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2092 | Ck8kQqXkroE4Vc1.exe | C:\Users\admin\AppData\Local\Temp\tmpF733.tmp | xml | |
MD5:8787935EE2D5047409F34BB52CE55FFB | SHA256:9FE87F6EAA0806F9EB3DC2470EC2B00D2300A83F8787D48BBB9ED5032DF914F3 | |||
| 2092 | Ck8kQqXkroE4Vc1.exe | C:\Users\admin\AppData\Roaming\zZBPsxOyA.exe | executable | |
MD5:40E0B3CBB5FF5C75BE23297B12053AA0 | SHA256:035CF98A4ED96281EC028EC33C8A15C578E3157F9A1F8E90E95DDBC6204ADA29 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.8:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.86.11.11:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5640 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5640 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.8:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
4688 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.32.136:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.86.11.11:80 | ocsp.digicert.com | AKAMAI-AS | SE | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
www.looring-services329769.sbs |
| unknown |