analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SAMPLE.zip

Full analysis: https://app.any.run/tasks/7f7547bf-121a-41f7-88e8-d17c9d85bb96
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: July 17, 2019, 13:56:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
formbook
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

48A85BA8E3AB2852CF6707B5B29C319C

SHA1:

FE19B75C910003190B0BE287A1B5A999F99FF07B

SHA256:

469C4E2DEC22CC008F8B53D727EE3CFABC5A1F71682C0E3B7153FB35B0F15D54

SSDEEP:

6144:qJdvXfOsIWGAmli1oHv9PfyAGpziosU4cU75Gxqse2:qLGsIWGX7HFTGpGDL7Exqse2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Marceline.exe (PID: 2512)
      • Marceline.exe (PID: 4028)
      • q2kdh1b0.exe (PID: 2336)
    • Changes the autorun value in the registry

      • dwm.exe (PID: 2296)
    • FORMBOOK was detected

      • explorer.exe (PID: 304)
    • Connects to CnC server

      • explorer.exe (PID: 304)
    • Actions looks like stealing of personal data

      • dwm.exe (PID: 2296)
    • Formbook was detected

      • Firefox.exe (PID: 2848)
      • dwm.exe (PID: 2296)
    • Stealing of credential data

      • dwm.exe (PID: 2296)
  • SUSPICIOUS

    • Application launched itself

      • Marceline.exe (PID: 2512)
    • Starts CMD.EXE for commands execution

      • dwm.exe (PID: 2296)
    • Creates files in the user directory

      • dwm.exe (PID: 2296)
    • Loads DLL from Mozilla Firefox

      • dwm.exe (PID: 2296)
    • Executable content was dropped or overwritten

      • explorer.exe (PID: 304)
      • DllHost.exe (PID: 3616)
    • Executed via COM

      • DllHost.exe (PID: 3616)
    • Creates files in the program directory

      • DllHost.exe (PID: 3616)
  • INFO

    • Manual execution by user

      • dwm.exe (PID: 2296)
      • Marceline.exe (PID: 2512)
    • Creates files in the user directory

      • Firefox.exe (PID: 2848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:07:17 13:56:08
ZipCRC: 0x94dcec64
ZipCompressedSize: 289182
ZipUncompressedSize: 552960
ZipFileName: 9867a91a12dc648686f0c8de29ac835a163aad18c4b2a58080eb2cd787af2d71.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs marceline.exe no specs marceline.exe no specs #FORMBOOK dwm.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs Copy/Move/Rename/Delete/Link Object q2kdh1b0.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2820"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SAMPLE.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2512"C:\Users\admin\Desktop\Marceline.exe" C:\Users\admin\Desktop\Marceline.exeexplorer.exe
User:
admin
Company:
bulling8
Integrity Level:
MEDIUM
Description:
consumptions
Exit code:
0
Version:
1.03.0004
4028C:\Users\admin\Desktop\Marceline.exe" C:\Users\admin\Desktop\Marceline.exeMarceline.exe
User:
admin
Company:
bulling8
Integrity Level:
MEDIUM
Description:
consumptions
Exit code:
0
Version:
1.03.0004
2296"C:\Windows\System32\dwm.exe"C:\Windows\System32\dwm.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3000/c del "C:\Users\admin\Desktop\Marceline.exe"C:\Windows\System32\cmd.exedwm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
304C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2848"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
dwm.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
67.0.4
3616C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2336"C:\Program Files\Loftp_r3\q2kdh1b0.exe"C:\Program Files\Loftp_r3\q2kdh1b0.exeexplorer.exe
User:
admin
Company:
bulling8
Integrity Level:
MEDIUM
Description:
consumptions
Version:
1.03.0004
Total events
3 072
Read events
3 048
Write events
24
Delete events
0

Modification events

(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2820) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SAMPLE.zip
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(304) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(304) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:MRUList
Value:
a
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
4
Suspicious files
82
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2820.32162\9867a91a12dc648686f0c8de29ac835a163aad18c4b2a58080eb2cd787af2d71.bin
MD5:
SHA256:
2296dwm.exeC:\Users\admin\AppData\Roaming\46A2P09E\46Alogrc.inibinary
MD5:68D3A607F17148CDFF0595B26605C0FB
SHA256:0647675AA83F674026500D0F789D6227F7698D298368093DE4C0E9D4B5257243
304explorer.exeC:\Users\admin\Desktop\Marceline.exeexecutable
MD5:8B1F6490A96C35ABFEAAAD0B7D40CAF6
SHA256:9867A91A12DC648686F0C8DE29AC835A163AAD18C4B2A58080EB2CD787AF2D71
304explorer.exeC:\Users\admin\Desktop\9867a91a12dc648686f0c8de29ac835a163aad18c4b2a58080eb2cd787af2d71.binexecutable
MD5:8B1F6490A96C35ABFEAAAD0B7D40CAF6
SHA256:9867A91A12DC648686F0C8DE29AC835A163AAD18C4B2A58080EB2CD787AF2D71
2848Firefox.exeC:\Users\admin\AppData\Roaming\46A2P09E\46Alogrf.inibinary
MD5:53028481B5B5795F1501241CCC7ABFF6
SHA256:75B5F3045E20C80F264568707E2D444DC7498DB119D9661AE51A91575960FC5A
2296dwm.exeC:\Users\admin\AppData\Roaming\46A2P09E\46Alogim.jpegimage
MD5:8CD19133CCF5C8B314B2D2C72C697756
SHA256:53B2A06E093CB8856D75B553DD1E2CAC94FE8C69315D66A47950B10815273A64
304explorer.exeC:\Users\admin\AppData\Local\Temp\Loftp_r3\q2kdh1b0.exeexecutable
MD5:8B1F6490A96C35ABFEAAAD0B7D40CAF6
SHA256:9867A91A12DC648686F0C8DE29AC835A163AAD18C4B2A58080EB2CD787AF2D71
3616DllHost.exeC:\Program Files\Loftp_r3\q2kdh1b0.exeexecutable
MD5:8B1F6490A96C35ABFEAAAD0B7D40CAF6
SHA256:9867A91A12DC648686F0C8DE29AC835A163AAD18C4B2A58080EB2CD787AF2D71
2296dwm.exeC:\Users\admin\AppData\Roaming\46A2P09E\46Alogri.inibinary
MD5:D63A82E5D81E02E399090AF26DB0B9CB
SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
2296dwm.exeC:\Users\admin\AppData\Roaming\46A2P09E\46Alogrv.inibinary
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5
SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
304
explorer.exe
GET
154.92.166.118:80
http://www.cnzippo.com/su/?CP=30im9yx3p50ck+KMFoRPFU5sPv4ECj3R6207bbm0HUczDVDYfa3a8ka3QxCOPB6EFrz1fg==&2d6H=YnJ4ANEp&sql=1
US
malicious
304
explorer.exe
GET
52.88.32.213:80
http://www.purplestoneproperties.com/su/?CP=GZT0rtEuVW7AoBrhNnmBCOEvb0ATIUoqnRIt5LhCaFbA+fECzt5yNXRmBde1/7dQpL863g==&2d6H=YnJ4ANEp
US
malicious
304
explorer.exe
POST
154.92.166.118:80
http://www.cnzippo.com/su/
US
malicious
304
explorer.exe
POST
154.92.166.118:80
http://www.cnzippo.com/su/
US
malicious
304
explorer.exe
POST
154.92.166.118:80
http://www.cnzippo.com/su/
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
304
explorer.exe
52.88.32.213:80
www.purplestoneproperties.com
Amazon.com, Inc.
US
malicious
304
explorer.exe
154.92.166.118:80
www.cnzippo.com
MULTACOM CORPORATION
US
malicious

DNS requests

Domain
IP
Reputation
www.turbocote.com
unknown
www.rpbsjy.men
unknown
www.purplestoneproperties.com
  • 52.88.32.213
malicious
www.mybarefootlifestyle.com
unknown
www.cnzippo.com
  • 154.92.166.118
malicious
www.ruyijubao.com
unknown

Threats

PID
Process
Class
Message
304
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
304
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
304
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
304
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
304
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
4 ETPRO signatures available at the full report
No debug info