File name:	SecuriteInfo.com.Win32.TrojanX-gen.9468.18275
Full analysis:	https://app.any.run/tasks/d580b0f6-9f8b-4072-8afd-362970b03700
Verdict:	Malicious activity
Threats:	FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	December 05, 2022, 18:34:44
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	formbook xloader trojan stealer
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	59EC68C614CBD08F061B98EE2F7558B6
SHA1:	518E36C73B44331E89A74C651DDF64E9AD79EE10
SHA256:	1546E632CB3CD6ABB0497A1E941D7C1AFEFD3D1BC7582B63F49D948241406B80
SSDEEP:	6144:ptxBKhzEHZ6pqRMVr5PdD1IQnAPJrueL9KEzbIgsfd+O2hht9lKSYS:ptLKhIZ60+VrVR/UJrueL9PbcV8jt9lH

.dll	\|	Win32 Dynamic Link Library (generic) (38.3)
.exe	\|	Win32 Executable (generic) (26.2)
.exe	\|	Win16/32 Executable Delphi generic (12)
.exe	\|	Generic Win/DOS Executable (11.6)
.exe	\|	DOS Executable Generic (11.6)

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	2103-Nov-18 21:46:25
Debug artifacts:	HNIOPLN.pdb
Comments:	-
CompanyName:	-
FileDescription:	HNIOPLN
FileVersion:	1.0.0.0
InternalName:	HNIOPLN.exe
LegalCopyright:	Copyright © 2022
LegalTrademarks:	-
OriginalFilename:	HNIOPLN.exe
ProductName:	HNIOPLN
ProductVersion:	1.0.0.0
Assembly Version:	1.0.0.0

e_magic:	MZ
e_cblp:	144
e_cp:	3
e_crlc:	-
e_cparhdr:	4
e_minalloc:	-
e_maxalloc:	65535
e_ss:	-
e_sp:	184
e_csum:	-
e_ip:	-
e_cs:	-
e_ovno:	-
e_oemid:	-
e_oeminfo:	-
e_lfanew:	128

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
NumberofSections:	5
TimeDateStamp:	2103-Nov-18 21:46:25
PointerToSymbolTable:	-
NumberOfSymbols:	-
SizeOfOptionalHeader:	224
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
X\x166F)"#\x19	8192	285236	285696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	7.99936
.text	294912	42028	42496	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	5.06849
.rsrc	344064	5858	6144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.35264
Section_4	352256	16	512	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	0.122276
.reloc	360448	12	512	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.0980042

Title	Entropy	Size	Codepage	Language	Type
1	4.15503	4264	UNKNOWN	UNKNOWN	RT_ICON
32512	1.7815	20	UNKNOWN	UNKNOWN	RT_GROUP_ICON
1 (#2)	3.27039	780	UNKNOWN	UNKNOWN	RT_VERSION
1 (#3)	5.00112	490	UNKNOWN	UNKNOWN	RT_MANIFEST


(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	ProxyEnable
Value: 0
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:	write	Name:	SavedLegacySettings
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(2752) services.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:	write	Name:	WpadDecisionReason
Value: 1

PID	Process	Filename		Type
2752	services.exe	C:\Users\admin\AppData\Local\Temp\1--Lt08NN		sqlite
		MD5:CC104C4E4E904C3AD7AD5C45FBFA7087	SHA256:321BE844CECC903EF1E7F875B729C96BB3ED0D4986314384CD5944A29A670C9B
2752	services.exe	C:\Users\admin\AppData\Local\Temp\sqlite3.def		text
		MD5:DE71633DE073966EB5D5F787EAC989BB	SHA256:C810A7589A228352269413CC503647DF82B4320B7C0B596A15D2842DAC7F843A
2752	services.exe	C:\Users\admin\AppData\Local\Temp\9ratq.zip		compressed
		MD5:16F94AEE2D9A53BF8E58722679063051	SHA256:43A12CC1C155D0BB9686A1FCBC90BABC9E99DBEC475BDDC2ACACF31BD2B159E8
2752	services.exe	C:\Users\admin\AppData\Local\Temp\sqlite3.dll		executable
		MD5:EDA40EA55FF2EB2A2E5ACA836BB1CC26	SHA256:330B88EACB778B86DFF1A90189121E8B3280723BE9FBF4E55174EDE2BBF74AF0
2752	services.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\sqlite-dll-win32-x86-3150000[1].zip		compressed
		MD5:16F94AEE2D9A53BF8E58722679063051	SHA256:43A12CC1C155D0BB9686A1FCBC90BABC9E99DBEC475BDDC2ACACF31BD2B159E8

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
576	Explorer.EXE	POST	—	94.23.162.163:80	http://www.darkchocolatebliss.com/4u5a/	DE	—	—	malicious
576	Explorer.EXE	POST	—	94.23.162.163:80	http://www.darkchocolatebliss.com/4u5a/	DE	—	—	malicious
576	Explorer.EXE	POST	—	94.23.162.163:80	http://www.darkchocolatebliss.com/4u5a/	DE	—	—	malicious
576	Explorer.EXE	POST	—	94.23.162.163:80	http://www.darkchocolatebliss.com/4u5a/	DE	—	—	malicious
576	Explorer.EXE	POST	—	94.23.162.163:80	http://www.darkchocolatebliss.com/4u5a/	DE	—	—	malicious
576	Explorer.EXE	POST	404	162.213.255.142:80	http://www.marketmall.digital/4u5a/	US	html	1.05 Kb	malicious
576	Explorer.EXE	POST	404	162.213.255.142:80	http://www.marketmall.digital/4u5a/	US	html	1.05 Kb	malicious
576	Explorer.EXE	GET	404	94.23.162.163:80	http://www.darkchocolatebliss.com/4u5a/?mJwHH0=pzMeEw2CLp9onsoEnDSOmc3gtX7SiKwXMIcMx0e8RMBYp3cHCqEf60/KvimOIvjijeVfzZ3ezI4K2kicxXlHHzx6auYw36b3X9e1iLc=&4h=I29L_rMXcnyh	DE	html	178 b	malicious
576	Explorer.EXE	GET	404	38.55.236.89:80	http://www.ope-cctv.com/4u5a/?mJwHH0=PpVjBZYmN65mN/CchdVCVsAoBpQ31OdI4sTzWlpX/jy1IrupfQnybysg8dMB5QjWo1YH+L33UlhflMYe95+OODsslcem/VRP4QLmUg0=&4h=I29L_rMXcnyh	US	html	146 b	malicious
576	Explorer.EXE	POST	405	89.31.143.1:80	http://www.dersameh.com/4u5a/	DE	html	150 b	malicious

PID	Process	IP	Domain	ASN	CN	Reputation
2752	services.exe	45.33.6.223:80	www.sqlite.org	Linode, LLC	US	suspicious
576	Explorer.EXE	89.31.143.1:80	www.dersameh.com	IP Exchange GmbH	DE	malicious
576	Explorer.EXE	38.55.236.89:80	www.ope-cctv.com	STARCLOUD GLOBAL PTE., LTD.	US	malicious
576	Explorer.EXE	94.23.162.163:80	www.darkchocolatebliss.com	OVH SAS	DE	malicious
—	—	94.23.162.163:80	www.darkchocolatebliss.com	OVH SAS	DE	malicious
576	Explorer.EXE	154.209.6.241:80	www.y31jaihdb6zm87.buzz	YISU CLOUD LTD	HK	malicious
576	Explorer.EXE	162.213.255.142:80	www.marketmall.digital	NAMECHEAP-NET	US	malicious

Domain	IP	Reputation
www.ope-cctv.com	38.55.236.89	malicious
www.sqlite.org	45.33.6.223	whitelisted
www.dersameh.com	89.31.143.1	malicious
www.darkchocolatebliss.com	94.23.162.163	malicious
www.y31jaihdb6zm87.buzz	154.209.6.241	malicious
www.marketmall.digital	162.213.255.142	malicious

PID	Process	Class	Message
576	Explorer.EXE	Generic Protocol Command Decode	SURICATA HTTP Unexpected Request body
576	Explorer.EXE	A Network Trojan was detected	ET TROJAN FormBook CnC Checkin (GET)
576	Explorer.EXE	A Network Trojan was detected	ET TROJAN FormBook CnC Checkin (GET)
576	Explorer.EXE	A Network Trojan was detected	ET TROJAN FormBook CnC Checkin (GET)
576	Explorer.EXE	Generic Protocol Command Decode	SURICATA HTTP Unexpected Request body
576	Explorer.EXE	Generic Protocol Command Decode	SURICATA HTTP Unexpected Request body
—	—	Generic Protocol Command Decode	SURICATA HTTP Unexpected Request body
576	Explorer.EXE	Generic Protocol Command Decode	SURICATA HTTP Unexpected Request body
576	Explorer.EXE	Generic Protocol Command Decode	SURICATA HTTP Unexpected Request body
576	Explorer.EXE	A Network Trojan was detected	ET TROJAN FormBook CnC Checkin (POST) M2

General Info

SecuriteInfo.com.Win32.TrojanX-gen.9468.18275

59EC68C614CBD08F061B98EE2F7558B6

518E36C73B44331E89A74C651DDF64E9AD79EE10

1546E632CB3CD6ABB0497A1E941D7C1AFEFD3D1BC7582B63F49D948241406B80

6144:ptxBKhzEHZ6pqRMVr5PdD1IQnAPJrueL9KEzbIgsfd+O2hht9lKSYS:ptLKhIZ60+VrVR/UJrueL9PbcV8jt9lH

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

FORMBOOK detected by memory dumps

Formbook is detected

FORMBOOK was detected

Connects to the CnC server

Unusual connection from system programs

Loads dropped or rewritten executable

SUSPICIOUS

Loads DLL from Mozilla Firefox

Reads browser cookies

Process drops SQLite DLL files

INFO

Reads the computer name

Checks supported languages

Process checks computer location settings

Manual execution by a user

Checks proxy server information

Executable content was dropped or overwritten

Drops the executable file immediately after the start

Drops a file that was compiled in debug mode

Creates a file in a temporary directory

Malware configuration

Formbook

Static information

TRiD

Summary

DOS Header

PE Headers

Sections

Resources

Imports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Malware configuration

Formbook

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings