File name:

RASHID HOSPITAL PO1287578495.exe

Full analysis: https://app.any.run/tasks/edbfc31e-566e-4dbd-b4f3-ddcb4900bad0
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: July 05, 2023, 12:30:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
formbook
xloader
trojan
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

6B5391B3FD886324B88E034A61BD2612

SHA1:

C386669F065C1C111733D1CEF2DEC6B9DCD0E089

SHA256:

086958FA9CCD6FD426C1C627ECA3412870B41F0EEF471663BF8EA5F0C19C5C8A

SSDEEP:

12288:q+KUalCxLL9zGkcC1vitlflRXgmsnowyWGW1lzSi90Ivk3GRRfaUr:LX4ChhzGkcCgNqnRl1pcIvkCyA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK was detected

      • explorer.exe (PID: 1960)

    • FORMBOOK detected by memory dumps

      • chkdsk.exe (PID: 2876)

    • Connects to the CnC server

      • explorer.exe (PID: 1960)

  • SUSPICIOUS

    • Application launched itself

      • RASHID HOSPITAL PO1287578495.exe (PID: 2440)

    • Starts CMD.EXE for commands execution

      • chkdsk.exe (PID: 2876)

  • INFO

    • Reads the computer name

      • RASHID HOSPITAL PO1287578495.exe (PID: 2440)
      • RASHID HOSPITAL PO1287578495.exe (PID: 2728)

    • Checks supported languages

      • RASHID HOSPITAL PO1287578495.exe (PID: 2440)
      • RASHID HOSPITAL PO1287578495.exe (PID: 2728)

    • The process checks LSA protection

      • RASHID HOSPITAL PO1287578495.exe (PID: 2440)

    • Reads the machine GUID from the registry

      • RASHID HOSPITAL PO1287578495.exe (PID: 2440)

    • Manual execution by a user

      • chkdsk.exe (PID: 2876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(2876) chkdsk.exe
C2www.amepromorapida.com/g63s/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)kmfqjx.com
streettrends-us.com
mfong.online
galagames-gtu11.com
52845.net
jdecorhome53.com
daclab.com
smart-lock-18812.bond
tammiesalterations.com
gofreshjuice.store
airecall.online
hanguob2c.com
backpackxx.com
severnbbq.com
lojaaquitem.top
xxyanliao.com
loansrange.com
englishbooks.store
ftd48x.cyou
meguro-19.site
scentroller.com
lygbokl.com
mcps-ga.com
hm-revenueandcustoms.com
monetizandoconteudos.com
smsabu.com
amarosekolp.cfd
weekpriority.com
arsuzcobankurtarma.com
jpacheco.net
igelnailelpaso.com
teambougiebedard.com
dobbytoken.com
almanavarrorealtor.com
qballmarket.space
gggop6.com
fsenyc.com
labadie-torphy.buzz
sakconsultant.com
hphmysterygems.club
caseycreativeco.com
fengjin-pharma.com
baousai.com
doordashfirsttime.delivery
recipes-12289.bond
brandspa.club
sapori-quincy.com
lega.care
tryskincell.com
moniola.com
ltgdlkh.fun
poshrite.info
spitzpartner.com
bangongzi.com
facai-bd15.com
uxykhcyhy.top
mailerbd.com
sunshineblogs.com
mylosgabletescoralinos.com
jackalopebrewingcompany.com
pepemargo.com
5599s.vip
14481.live
dartlogistics.info
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

AssemblyVersion: 1.0.0.0
ProductVersion: 1.0.0.0
ProductName: Quan UI
OriginalFileName: TfVx.exe
LegalTrademarks: -
LegalCopyright: Copyright © 2018
InternalName: TfVx.exe
FileVersion: 1.0.0.0
FileDescription: Quan UI
CompanyName: Microsoft
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x9cdfa
UninitializedDataSize: -
InitializedDataSize: 2048
CodeSize: 634368
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2085:11:02 01:57:00+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 02-Nov-2085 01:57:00
Debug artifacts:
  • TfVx.pdb
Comments: -
CompanyName: Microsoft
FileDescription: Quan UI
FileVersion: 1.0.0.0
InternalName: TfVx.exe
LegalCopyright: Copyright © 2018
LegalTrademarks: -
OriginalFilename: TfVx.exe
ProductName: Quan UI
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 02-Nov-2085 01:57:00
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x0009AE00
0x0009AE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.56368
.rsrc
0x0009E000
0x000005A4
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.07748
.reloc
0x000A0000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rashid hospital po1287578495.exe no specs rashid hospital po1287578495.exe no specs #FORMBOOK chkdsk.exe no specs cmd.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1960C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2440"C:\Users\admin\AppData\Local\Temp\RASHID HOSPITAL PO1287578495.exe" C:\Users\admin\AppData\Local\Temp\RASHID HOSPITAL PO1287578495.exe—explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Quan UI
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rashid hospital po1287578495.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
2728"C:\Users\admin\AppData\Local\Temp\RASHID HOSPITAL PO1287578495.exe"C:\Users\admin\AppData\Local\Temp\RASHID HOSPITAL PO1287578495.exe—RASHID HOSPITAL PO1287578495.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Quan UI
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rashid hospital po1287578495.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2876"C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Check Disk Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\chkdsk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Formbook
(PID) Process(2876) chkdsk.exe
C2www.amepromorapida.com/g63s/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)kmfqjx.com
streettrends-us.com
mfong.online
galagames-gtu11.com
52845.net
jdecorhome53.com
daclab.com
smart-lock-18812.bond
tammiesalterations.com
gofreshjuice.store
airecall.online
hanguob2c.com
backpackxx.com
severnbbq.com
lojaaquitem.top
xxyanliao.com
loansrange.com
englishbooks.store
ftd48x.cyou
meguro-19.site
scentroller.com
lygbokl.com
mcps-ga.com
hm-revenueandcustoms.com
monetizandoconteudos.com
smsabu.com
amarosekolp.cfd
weekpriority.com
arsuzcobankurtarma.com
jpacheco.net
igelnailelpaso.com
teambougiebedard.com
dobbytoken.com
almanavarrorealtor.com
qballmarket.space
gggop6.com
fsenyc.com
labadie-torphy.buzz
sakconsultant.com
hphmysterygems.club
caseycreativeco.com
fengjin-pharma.com
baousai.com
doordashfirsttime.delivery
recipes-12289.bond
brandspa.club
sapori-quincy.com
lega.care
tryskincell.com
moniola.com
ltgdlkh.fun
poshrite.info
spitzpartner.com
bangongzi.com
facai-bd15.com
uxykhcyhy.top
mailerbd.com
sunshineblogs.com
mylosgabletescoralinos.com
jackalopebrewingcompany.com
pepemargo.com
5599s.vip
14481.live
dartlogistics.info
3016/c del "C:\Users\admin\AppData\Local\Temp\RASHID HOSPITAL PO1287578495.exe"C:\Windows\SysWOW64\cmd.exe—chkdsk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
95
Read events
95
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
2
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1960
explorer.exe
GET
—
170.130.208.130:80
http://www.smsabu.com/g63s/?rZ=rBWgcbvyGvC1srDT/6gEIiw+cP9WHfQ5RAfNL7CBRj6oDijPFuoLSISEy+R/zE17AmTIGg==&sBZxw2=FxopsJPxCFPPD
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1960
explorer.exe
170.130.208.130:80
www.smsabu.com
AS62904
US
malicious

DNS requests

Domain
IP
Reputation
www.bangongzi.com
  • —
unknown
www.smsabu.com
  • 170.130.208.130
malicious

Threats

PID
Process
Class
Message
1960
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RASHID HOSPITAL PO1287578495.exe