| File name: | 1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b |
| Full analysis: | https://app.any.run/tasks/cbf464b9-b1fd-48ad-a152-ad49bfb57145 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | May 14, 2025, 22:30:42 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections |
| MD5: | 1F6A213C979C6ADFF88E31E059D2825D |
| SHA1: | 9E5A485A7B5ABCECF28B4A039E3AA1B350835740 |
| SHA256: | 1821C32E23FF7A3CFB87213F9299EB280CC0152C4170698CE16C6831B627779B |
| SSDEEP: | 12288:ofmEyEpOfo8zwg9BQcjdIRthxglZ95UY4pxm09B2hN+Z:oftyEpko8Mg9BQc5IRthxg39iY4pxm0l |
MALICIOUS
FORMBOOK has been detected
- svchost.exe (PID: 5048)
- explorer.exe (PID: 5492)
FORMBOOK has been detected (YARA)
- svchost.exe (PID: 5048)
Connects to the CnC server
- explorer.exe (PID: 5492)
FORMBOOK has been detected (SURICATA)
- explorer.exe (PID: 5492)
SUSPICIOUS
Executable content was dropped or overwritten
- 1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b.exe (PID: 2432)
Application launched itself
- kujfc.exe (PID: 5304)
Starts CMD.EXE for commands execution
- svchost.exe (PID: 5048)
Contacting a server suspected of hosting an CnC
- explorer.exe (PID: 5492)
INFO
Checks supported languages
- 1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b.exe (PID: 2432)
- kujfc.exe (PID: 5304)
- kujfc.exe (PID: 6068)
Manual execution by a user
- svchost.exe (PID: 5048)
Reads the computer name
- kujfc.exe (PID: 6068)
Create files in a temporary directory
- 1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b.exe (PID: 2432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(5048) svchost.exe
C2www.glocraze.com/ju29/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
f-end
Decoy C2 (64)xpermate.com
bacheckadress.top
jsrents.com
xuangesmd.com
mnchentampere.com
iamdebs.com
gwadkoup.com
shoplittlezenone.shop
jokergiftcard.buzz
durufilmyapim.com
sahabatterbaik19.xyz
decode.tax
wokeeducationhateskids.com
klxcv.xyz
dosfronterastx.com
desertmoneymedia.com
coynemanagement.online
housesstore.com
refreshquota.site
hijama-pro.com
gaming-chairs-vn-vi-2885437.fyi
tuesdaymorningwuwu.com
olivealley.online
lineyours.com
giollgoshop.site
kelashealing.com
spisanierussiadolgfaster.store
bodacristianyjuani.com
shop-hustlermindset.com
theadelts.com
umertazkeer.com
infinitytrustbank.com
thauthia12.click
shutupandjam.net
magick-cat.com
power-pro.online
wealthwithkate.com
ascorpii.com
quasi-discreetanga.best
mzfgwh.top
christopherromanski.online
townstart.shop
dwijtechnology.com
rezultman.info
e9pf4s.top
pabmb5.top
kprgrecruiting.com
betmcc.pro
girlypopups.com
sellwithimam.com
affordable58078.com
sextapevidhot.com
zg9tywlubmftzw5ldzmzmzk.com
dilapakku.com
tabareviera.com
helpers4us.com
sklm888.com
greenspaces.xyz
merchascarpamici.com
ibrahimalnajjar.com
xxds02.com
idsuper-21.online
naaraelucas.com
hearing-aid-new.click
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:04:02 03:20:13+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 24576 |
| InitializedDataSize: | 164864 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x312a |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
136
Monitored processes
11
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1672 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | kujfc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1912 | /c del "C:\Users\admin\AppData\Local\Temp\kujfc.exe" | C:\Windows\SysWOW64\cmd.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2240 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2432 | "C:\Users\admin\AppData\Local\Temp\1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b.exe" | C:\Users\admin\AppData\Local\Temp\1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5048 | "C:\Windows\SysWOW64\svchost.exe" | C:\Windows\SysWOW64\svchost.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
Formbook(PID) Process(5048) svchost.exe C2www.glocraze.com/ju29/ Strings (79)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start f-end Decoy C2 (64)xpermate.com bacheckadress.top jsrents.com xuangesmd.com mnchentampere.com iamdebs.com gwadkoup.com shoplittlezenone.shop jokergiftcard.buzz durufilmyapim.com sahabatterbaik19.xyz decode.tax wokeeducationhateskids.com klxcv.xyz dosfronterastx.com desertmoneymedia.com coynemanagement.online housesstore.com refreshquota.site hijama-pro.com gaming-chairs-vn-vi-2885437.fyi tuesdaymorningwuwu.com olivealley.online lineyours.com giollgoshop.site kelashealing.com spisanierussiadolgfaster.store bodacristianyjuani.com shop-hustlermindset.com theadelts.com umertazkeer.com infinitytrustbank.com thauthia12.click shutupandjam.net magick-cat.com power-pro.online wealthwithkate.com ascorpii.com quasi-discreetanga.best mzfgwh.top christopherromanski.online townstart.shop dwijtechnology.com rezultman.info e9pf4s.top pabmb5.top kprgrecruiting.com betmcc.pro girlypopups.com sellwithimam.com affordable58078.com sextapevidhot.com zg9tywlubmftzw5ldzmzmzk.com dilapakku.com tabareviera.com helpers4us.com sklm888.com greenspaces.xyz merchascarpamici.com ibrahimalnajjar.com xxds02.com idsuper-21.online naaraelucas.com hearing-aid-new.click | |||||||||||||||
| 5304 | "C:\Users\admin\AppData\Local\Temp\kujfc.exe" | C:\Users\admin\AppData\Local\Temp\kujfc.exe | — | 1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5492 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5936 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5968 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
834
Read events
832
Write events
1
Delete events
1
Modification events
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000080294 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456BFA0DB55E4278845B426357D5B5F97B3 | |||
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000080294 |
| Operation: | delete key | Name: | (default) |
Value: | |||
Executable files
1
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2432 | 1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b.exe | C:\Users\admin\AppData\Local\Temp\kujfc.exe | executable | |
MD5:B0EA3EDC8ACB7EE881FDA62156A64372 | SHA256:5929DBE846F0461701404D3837F535171404619DCB6CA325297AD291D25E2598 | |||
| 5492 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
| 2432 | 1821c32e23ff7a3cfb87213f9299eb280cc0152c4170698ce16c6831b627779b.exe | C:\Users\admin\AppData\Local\Temp\ivlxhggnweo.hp | binary | |
MD5:F3B1ACF81714166ADD61B560629A58C2 | SHA256:3A95138C28654D7510A497B678276074AC6EB50982E03E8BB5DDA85F18275A2D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
12
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5492 | explorer.exe | GET | 301 | 34.149.87.45:80 | http://www.ibrahimalnajjar.com/ju29/?2dwpI8=ijd/XO6Nzkwjk2HbpGm0nxtU7GV/kYE5Vb83p4idtTa0oyV/QK8Pb89xHRaQUi3Uxh7I&9rN0t8=O48d1Rax9paHN | unknown | — | — | malicious |
— | — | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4776 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4776 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.159.23:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
www.ibrahimalnajjar.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |