File name:

BITUMEN 60-70 - JUMBO Specification.exe

Full analysis: https://app.any.run/tasks/164f1684-67f8-4e0b-a249-08a4ac9a6b49
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: December 05, 2023, 07:19:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
formbook
stealer
spyware
opendir
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

80B59ED5833C271588CDFD66E9D1C32E

SHA1:

E1F9508E21425BCA725AD61656C2A5135D36668E

SHA256:

22CDE5846EE30F1DFE98E7A19FFD6E469FB86D3CD2AEF33394820DE39972C524

SSDEEP:

12288:EG3rsYqAUCi4TprWU3V1QtkXYD9o5M2wYc/Gg2bCv0FPcSY5:E58iUoU3V1QtkXYB0UGgfv0eSY5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BITUMEN 60-70 - JUMBO Specification.exe (PID: 2208)

    • Steals credentials

      • wlanext.exe (PID: 3052)

    • Actions looks like stealing of personal data

      • wlanext.exe (PID: 3052)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Connects to the CnC server

      • explorer.exe (PID: 1944)

  • SUSPICIOUS

    • Application launched itself

      • perwh.exe (PID: 2200)

    • Reads the Internet Settings

      • wlanext.exe (PID: 3052)

    • Process drops SQLite DLL files

      • wlanext.exe (PID: 3052)

  • INFO

    • Checks supported languages

      • BITUMEN 60-70 - JUMBO Specification.exe (PID: 2208)
      • perwh.exe (PID: 2200)
      • perwh.exe (PID: 1940)

    • Create files in a temporary directory

      • BITUMEN 60-70 - JUMBO Specification.exe (PID: 2208)
      • wlanext.exe (PID: 3052)

    • Reads the computer name

      • BITUMEN 60-70 - JUMBO Specification.exe (PID: 2208)

    • Creates files or folders in the user directory

      • wlanext.exe (PID: 3052)

    • Drops the executable file immediately after the start

      • wlanext.exe (PID: 3052)

    • Checks proxy server information

      • wlanext.exe (PID: 3052)

    • Manual execution by a user

      • wlanext.exe (PID: 3052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:02 05:20:05+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 120320
UninitializedDataSize: 1024
EntryPoint: 0x30fb
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.99.0.1
ProductVersionNumber: 2.99.0.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: deliver
FileDescription: tolerant
FileVersion: 2.99.0.1
ProductName: preoccupation
ProductVersion: 2.99.0.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bitumen 60-70 - jumbo specification.exe no specs perwh.exe no specs perwh.exe no specs wlanext.exe #FORMBOOK explorer.exe firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1408"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—wlanext.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1940"C:\Users\admin\AppData\Local\Temp\perwh.exe"C:\Users\admin\AppData\Local\Temp\perwh.exe—perwh.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\perwh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2200"C:\Users\admin\AppData\Local\Temp\perwh.exe" C:\Users\admin\AppData\Local\Temp\perwh.exe—BITUMEN 60-70 - JUMBO Specification.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\perwh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2208"C:\Users\admin\AppData\Local\Temp\BITUMEN 60-70 - JUMBO Specification.exe" C:\Users\admin\AppData\Local\Temp\BITUMEN 60-70 - JUMBO Specification.exe—explorer.exe
User:
admin
Company:
deliver
Integrity Level:
MEDIUM
Description:
tolerant
Exit code:
0
Version:
2.99.0.1
Modules
Images
c:\users\admin\appdata\local\temp\bitumen 60-70 - jumbo specification.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
3052"C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Wireless LAN 802.11 Extensibility Framework
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\wlanext.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
3 418
Read events
3 400
Write events
18
Delete events
0

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3052) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E7070C00020005000700150024009703010000001E768127E028094199FEB9D127C57AFE
Executable files
2
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3052wlanext.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\sqlite-dll-win32-x86-3190000[1].zipcompressed
MD5:6366B1751087BA991F1B4188A3F38486
SHA256:3102600D3AD67B0E3F132BC0F8E0E66D976BA3700C3CC96459B65A87FA57C373
2208BITUMEN 60-70 - JUMBO Specification.exeC:\Users\admin\AppData\Local\Temp\neuwwawdh.zbinary
MD5:8C6DE12485866CA07515A0526CB2BC93
SHA256:2828781462C832BBF3DC8EC3017B025B399693A8D2CD2ED150D2E9FD615E64BF
3052wlanext.exeC:\Users\admin\AppData\Local\Temp\c5h3-5L4binary
MD5:CEB39527E05115BBE0227EA14D897374
SHA256:D3406398F5A7D00D94E1F36065ACC5C63DBF27FB4026D75FB09129DDD05C2D20
2208BITUMEN 60-70 - JUMBO Specification.exeC:\Users\admin\AppData\Local\Temp\perwh.exeexecutable
MD5:90BB782161BA7272C24D72DA8FF0775C
SHA256:D854887B30F2BABBED59062EE85E9CCDEA16F9817C4328CC03851D66D2570BC1
3052wlanext.exeC:\Users\admin\AppData\Local\Temp\azrtmt.zipcompressed
MD5:6366B1751087BA991F1B4188A3F38486
SHA256:3102600D3AD67B0E3F132BC0F8E0E66D976BA3700C3CC96459B65A87FA57C373
3052wlanext.exeC:\Users\admin\AppData\Local\Temp\sqlite3.dllexecutable
MD5:F4D8BE409D1BD016A7B3B2580A2B90FB
SHA256:D70B27121BB33012560B14A7BD597666D76193D7DC5F89E2AC5E7507240BF708
3052wlanext.exeC:\Users\admin\AppData\Local\Temp\sqlite3.deftext
MD5:236236B6B95270B56C22F72FA7DFEC5C
SHA256:C5EDF6AFD22DD7FD0EFA2996716F25CD739731CAEA328532A8FD6EC64600E630
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
22
DNS requests
4
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
explorer.exe
GET
404
67.212.175.162:80
http://www.northjerseylocksmith.net/2nbp/?mn=tQVjVQ6bjwqqy2lbR5j5Jhkkbv+mz7pGdMEYuGKFTCiSTnfJxBy0UXkCydE2hBxIZqtMWqAAdfU1HGr2/0pBnFWnBLOOmDxzRr3LdZo=&M4mBS=rPyD
unknown
html
315 b
unknown
1944
explorer.exe
POST
404
195.110.124.133:80
http://www.daicheevenerdi.shop/2nbp/
unknown
html
203 b
unknown
1944
explorer.exe
POST
404
195.110.124.133:80
http://www.daicheevenerdi.shop/2nbp/
unknown
html
203 b
unknown
1944
explorer.exe
POST
404
195.110.124.133:80
http://www.daicheevenerdi.shop/2nbp/
unknown
html
203 b
unknown
1944
explorer.exe
POST
404
195.110.124.133:80
http://www.daicheevenerdi.shop/2nbp/
unknown
html
203 b
unknown
1944
explorer.exe
GET
404
195.110.124.133:80
http://www.daicheevenerdi.shop/2nbp/?mn=CatgNxddABofU2xxbzIHnPVyvfpIc9RL22pvia93oGhQXA0pKmuMk0QAMn14ihLnFplzFQgyVdVNwR0Vvhw9Ia+ljKFddUDviCek6pI=&M4mBS=rPyD
unknown
html
203 b
unknown
3052
wlanext.exe
GET
200
45.33.6.223:80
http://www.sqlite.org/2017/sqlite-dll-win32-x86-3190000.zip
unknown
compressed
434 Kb
unknown
1944
explorer.exe
POST
404
195.110.124.133:80
http://www.daicheevenerdi.shop/2nbp/
unknown
html
203 b
unknown
1944
explorer.exe
POST
404
82.163.176.124:80
http://www.elegacyofbeauty.com/2nbp/
unknown
html
10.1 Kb
unknown
1944
explorer.exe
POST
—
82.163.176.124:80
http://www.elegacyofbeauty.com/2nbp/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1944
explorer.exe
67.212.175.162:80
www.northjerseylocksmith.net
SINGLEHOP-LLC
US
unknown
3052
wlanext.exe
45.33.6.223:80
www.sqlite.org
Linode, LLC
US
unknown
1944
explorer.exe
195.110.124.133:80
www.daicheevenerdi.shop
Register S.p.A.
IT
unknown
1944
explorer.exe
82.163.176.124:80
www.elegacyofbeauty.com
Wildcard UK Limited
GB
unknown

DNS requests

Domain
IP
Reputation
www.northjerseylocksmith.net
  • 67.212.175.162
unknown
www.sqlite.org
  • 45.33.6.223
whitelisted
www.daicheevenerdi.shop
  • 195.110.124.133
unknown
www.elegacyofbeauty.com
  • 82.163.176.124
unknown

Threats

Found threats are available for the paid subscriptions
14 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BITUMEN 60-70 - JUMBO Specification.exe