| File name: | wUGUduxbaEGZJVv.exe |
| Full analysis: | https://app.any.run/tasks/608ae873-cbbf-407b-90f5-77b62c59322f |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | April 29, 2025, 10:33:56 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 46BBF0505A2C283CF2B087C14DA68957 |
| SHA1: | B1B3A09999CF2E479D6ADE75516C7517C9102101 |
| SHA256: | 2CADED000F82486CAADE3EEB6C47D446037ABDCB39A2BA127B58C9FC67D15F33 |
| SSDEEP: | 24576:zY93v5IKLnsyTizn/cCpVnNpQjqZJESdxWTZcrZS0Fla8o1K9H:k93v5IKLnsyTizn/cCpVnNpQjqZJESdf |
MALICIOUS
Uses Task Scheduler to run other applications
- wUGUduxbaEGZJVv.exe (PID: 7000)
FORMBOOK has been detected
- svchost.exe (PID: 5576)
FORMBOOK has been detected (YARA)
- svchost.exe (PID: 5576)
SUSPICIOUS
Executable content was dropped or overwritten
- wUGUduxbaEGZJVv.exe (PID: 7000)
The process executes VB scripts
- wUGUduxbaEGZJVv.exe (PID: 7000)
Reads security settings of Internet Explorer
- wUGUduxbaEGZJVv.exe (PID: 7000)
Starts CMD.EXE for commands execution
- svchost.exe (PID: 5576)
Deletes system .NET executable
- cmd.exe (PID: 4220)
INFO
Reads the machine GUID from the registry
- wUGUduxbaEGZJVv.exe (PID: 7000)
Checks supported languages
- wUGUduxbaEGZJVv.exe (PID: 7000)
- vbc.exe (PID: 1660)
Reads the computer name
- wUGUduxbaEGZJVv.exe (PID: 7000)
- vbc.exe (PID: 1660)
Creates files or folders in the user directory
- wUGUduxbaEGZJVv.exe (PID: 7000)
Create files in a temporary directory
- wUGUduxbaEGZJVv.exe (PID: 7000)
Process checks computer location settings
- wUGUduxbaEGZJVv.exe (PID: 7000)
Manual execution by a user
- svchost.exe (PID: 5576)
Reads the software policy settings
- slui.exe (PID: 2284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(5576) svchost.exe
C2www.gsp657.top/hi13/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
f-end
Decoy C2 (64)olidspot.shop
aise-your-voice.sbs
9ydygorig3l7z.xyz
netuzio.xyz
erspacehealthandwellness.info
hbnzk.cfd
uklor.shop
tudiofoti.pro
onety.skin
iralavinc.online
teelpath.shop
w-yudfjp.shop
betka.xyz
lx2cbhe5vee0e1.xyz
ndotoverf.pro
loud-sevice.click
enckubs.shop
anpack.shop
nity-3d-development.dev
iaolento12.sbs
xectgroup.net
avakey.shop
kfast.store
ayeewenvqzqm.top
66xq2.top
cvaultshielded.live
5zbm0.cfd
g1wszulqv7lc.xyz
rog.top
xplosion-proof.lat
aysec.net
999game.website
3a4p8gq8bojwn.xyz
x92q.top
akextow.net
t775.top
873013.xyz
tu1x120.top
9882aa1216.autos
ayarwarna21.live
ardengoal.net
8ln62.cfd
elvetvoiceskiresorts.website
kpqh.town
njjwh.info
movps.net
pb79kasy.vip
ellbar.shop
inktrim.xyz
hagrinleemotooltechus.shop
olayl
tp-batik77-1.vip
looring-services329769.sbs
130t.xyz
9gi02.cfd
elayrunway.shop
phones-br.sbs
aser-skin-treatment-95250.bond
ry-prodentims.shop
rtelegans.art
01411.club
it4n1ar4t0k7o0.xyz
igitalmilanolegacy.shop
ompanion.bio
TRiD
| .scr | | | Windows screen saver (46.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (23.3) |
| .exe | | | Win32 Executable (generic) (15.9) |
| .exe | | | Generic Win/DOS Executable (7.1) |
| .exe | | | DOS Executable Generic (7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2068:02:24 11:49:47+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 747520 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb86f2 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | HP Inc. |
| FileDescription: | Sgm_Student_Information |
| FileVersion: | 1.0.0.0 |
| InternalName: | BroG.exe |
| LegalCopyright: | Copyright © HP Inc. 2023 |
| LegalTrademarks: | - |
| OriginalFileName: | BroG.exe |
| ProductName: | Sgm_Student_Information |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
141
Monitored processes
13
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1056 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1660 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | — | wUGUduxbaEGZJVv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 14.8.9037.0 Modules
| |||||||||||||||
| 1812 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | — | wUGUduxbaEGZJVv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 4294967295 Version: 14.8.9037.0 Modules
| |||||||||||||||
| 1912 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2284 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3156 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4220 | /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" | C:\Windows\SysWOW64\cmd.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4448 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | — | wUGUduxbaEGZJVv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 4294967295 Version: 14.8.9037.0 Modules
| |||||||||||||||
| 5404 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
1 167
Read events
1 167
Write events
0
Delete events
0
Modification events
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7000 | wUGUduxbaEGZJVv.exe | C:\Users\admin\AppData\Roaming\jsPhfd.exe | executable | |
MD5:46BBF0505A2C283CF2B087C14DA68957 | SHA256:2CADED000F82486CAADE3EEB6C47D446037ABDCB39A2BA127B58C9FC67D15F33 | |||
| 7000 | wUGUduxbaEGZJVv.exe | C:\Users\admin\AppData\Local\Temp\tmpFA6F.tmp | xml | |
MD5:4DA024E508FB9B5F2FC5A42637498CB4 | SHA256:32D162AC36D15AF3912616EF49F4CB0748E8637D8168C4B4D47A3A66BD7E9DFC | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.72:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
632 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
632 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.164.72:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6544 | svchost.exe | 40.126.31.130:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |