analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

asd.exe

Full analysis: https://app.any.run/tasks/32f084a2-e774-4d22-9eb7-a95f73c9ddad
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: October 14, 2019, 16:02:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
formbook
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

42ACCB0201171CC57B7DBD9586CF0880

SHA1:

37674D71DB7D2AACB0D9C1C41B1C685882EF0098

SHA256:

36BBA23623744AE753684D4266EC946EEF96F76ADE08BFE68F7EDECC0F9150C3

SSDEEP:

3072:thKM9jlPZkXaXnB1Oo+NwOj6GO0TPbN0jUzgvMy+DOTOrhqNzkK:f1RBo/NZj6GO0TPbNP7y+DtJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs app for hidden code execution

      • explorer.exe (PID: 352)

    • Connects to CnC server

      • explorer.exe (PID: 352)

    • FORMBOOK was detected

      • explorer.exe (PID: 352)
      • cmd.exe (PID: 2644)
      • Firefox.exe (PID: 3984)

    • Changes the autorun value in the registry

      • cmd.exe (PID: 2644)

    • Actions looks like stealing of personal data

      • cmd.exe (PID: 2644)

    • Stealing of credential data

      • cmd.exe (PID: 2644)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 352)
      • cmd.exe (PID: 2644)

    • Application launched itself

      • cmd.exe (PID: 2644)

    • Creates files in the user directory

      • cmd.exe (PID: 2644)

    • Loads DLL from Mozilla Firefox

      • cmd.exe (PID: 2644)

    • Executed via COM

      • DllHost.exe (PID: 4000)

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 352)
      • DllHost.exe (PID: 4000)

    • Creates files in the program directory

      • DllHost.exe (PID: 4000)

  • INFO

    • Manual execution by user

      • cmd.exe (PID: 2644)

    • Reads the hosts file

      • cmd.exe (PID: 2644)

    • Creates files in the user directory

      • Firefox.exe (PID: 3984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2008:12:17 05:53:02+01:00
PEType: PE32
LinkerVersion: 10
CodeSize: 166912
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x1b640
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 17-Dec-2008 04:53:02

DOS Header

Magic number: MZ
Bytes on last page of file: 0x5245
Pages in file: 0x00E8
Relocations: 0x0000
Size of header: 0x5800
Min extra paragraphs: 0xE883
Max extra paragraphs: 0x8B09
Initial SS value: 0x83C8
Initial SP value: 0x3CC0
Checksum: 0x008B
Initial IP value: 0xC103
Initial CS value: 0xC083
Overlay number: 0xFF08
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 1
Time date stamp: 17-Dec-2008 04:53:02
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00028BE4
0x00028C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.42644
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start asd.exe no specs #FORMBOOK cmd.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs Copy/Move/Rename/Delete/Link Object gdinv1dcdu.exe no specs nbtstat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1648"C:\Users\admin\AppData\Local\Temp\asd.exe" C:\Users\admin\AppData\Local\Temp\asd.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2644"C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3388/c del "C:\Users\admin\AppData\Local\Temp\asd.exe"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3984"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
cmd.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
4000C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1584"C:\Program Files\Eadzxqhi\gdinv1dcdu.exe"C:\Program Files\Eadzxqhi\gdinv1dcdu.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2408"C:\Windows\System32\nbtstat.exe"C:\Windows\System32\nbtstat.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP NetBios Information
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
63
Read events
62
Write events
1
Delete events
0

Modification events

(PID) Process:(2644) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:GBPHFNCXDH
Value:
C:\Program Files\Eadzxqhi\gdinv1dcdu.exe
Executable files
2
Suspicious files
73
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2644cmd.exeC:\Users\admin\AppData\Roaming\NQ72CQDE\NQ7logrc.inibinary
MD5:2855A82ECDD565B4D957EC2EE05AED26
SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939
352explorer.exeC:\Users\admin\AppData\Local\Temp\Eadzxqhi\gdinv1dcdu.exeexecutable
MD5:42ACCB0201171CC57B7DBD9586CF0880
SHA256:36BBA23623744AE753684D4266EC946EEF96F76ADE08BFE68F7EDECC0F9150C3
2644cmd.exeC:\Users\admin\AppData\Roaming\NQ72CQDE\NQ7logim.jpegimage
MD5:031A98031ACE0ABB11D63E2AC22EAB0B
SHA256:CA410FA2830E06A05D01C5AE61543AA386D567C675A99257A97E9A82BDDB48F0
3984Firefox.exeC:\Users\admin\AppData\Roaming\NQ72CQDE\NQ7logrf.inibinary
MD5:53028481B5B5795F1501241CCC7ABFF6
SHA256:75B5F3045E20C80F264568707E2D444DC7498DB119D9661AE51A91575960FC5A
4000DllHost.exeC:\Program Files\Eadzxqhi\gdinv1dcdu.exeexecutable
MD5:42ACCB0201171CC57B7DBD9586CF0880
SHA256:36BBA23623744AE753684D4266EC946EEF96F76ADE08BFE68F7EDECC0F9150C3
2644cmd.exeC:\Users\admin\AppData\Roaming\NQ72CQDE\NQ7logri.inibinary
MD5:D63A82E5D81E02E399090AF26DB0B9CB
SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
2644cmd.exeC:\Users\admin\AppData\Roaming\NQ72CQDE\NQ7logrv.inibinary
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5
SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
352
explorer.exe
GET
—
184.168.221.47:80
http://www.beardedbutcherbrew.com/zg/?q4N=RoydoQdcBLp/X7gwK0AgTU/1gDJvJfoSN0KAjhGYVW06dEJLsrRr3cSUrdl1BBLEU6FiGw==&rTXd=LLrHh
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
352
explorer.exe
184.168.221.47:80
www.beardedbutcherbrew.com
GoDaddy.com, LLC
US
malicious

DNS requests

Domain
IP
Reputation
www.beardedbutcherbrew.com
  • 184.168.221.47
malicious

Threats

PID
Process
Class
Message
352
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
asd.exe