| File name: | 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe |
| Full analysis: | https://app.any.run/tasks/529c6678-39d5-4ace-a1b9-9cc56d0c8f72 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | June 11, 2024, 20:41:46 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | CF4167C690383362C4B42AB32A0EE1BA |
| SHA1: | 09A8E7792A20DF75FC6C466C921C6E3FB1B92985 |
| SHA256: | 48E036467595C63C65D8640A84F4BCF9545A20A9AC2596E8E555A4126C4E7CF7 |
| SSDEEP: | 24576:FNpsOL2Sg5u/6epjB1d3USdga8hgSEDjLxDl9bBFkS0ryjvH1z29RtnY:FNpsOL2Sg0/6epjB1d3USdga8hgSEDPv |
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:06:11 09:03:57+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 723456 |
| InitializedDataSize: | 101888 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb285e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | - |
| FileVersion: | 0.0.0.0 |
| InternalName: | DjqQk.exe |
| LegalCopyright: | - |
| LegalTrademarks: | - |
| OriginalFileName: | DjqQk.exe |
| ProductName: | - |
| ProductVersion: | 0.0.0.0 |
| AssemblyVersion: | 0.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1228 | "C:\Users\admin\AppData\Local\Temp\48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe" | C:\Users\admin\AppData\Local\Temp\48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
| 4472 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4996 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JdSqumW" /XML "C:\Users\admin\AppData\Local\Temp\tmp6ACD.tmp" | C:\Windows\SysWOW64\schtasks.exe | — | 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6168 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6268 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | — | 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 6340 | "C:\Windows\SysWOW64\cmmon32.exe" | C:\Windows\SysWOW64\cmmon32.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Connection Manager Monitor Version: 7.2.19041.1 (WinBuild.160101.0800) Modules
Formbook(PID) Process(6340) cmmon32.exe C2www.fight4yourhappiness.com/dd20/ Strings (79)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start f-end Decoy C2 (64)unblurd.com docu-zign.com randijpaulsen.com angsabet.com sedatelynx.com opiumcore.store thelordismysaviormerch.com mindstudio.support waterbygraceteam.com furnitureinspiredbythesea.com amablanca.com hespelerdental.com arcalid.net balajinursingbureau.online caixias.shop solingen-buergerstiftung.com 194916.top 6travel-insurance.xyz xn--fiqp9b17y.xn--czr694b syntixi.trade dataaudit.xyz judgefever.com agapornis.pet sparkasse-banking-service.app holylandmerch.com synive.com knittingbyangela.com keytorapidweightloss.com maradesarrollos.store asherveer.com kalame.info khuwezu.top myfreebd.com jeepcherokeedeals.xyz pointschauds.net narae.xyz nsivyyu.top vetlinx360.com 1709frankford.com checchintrasportilogistica.com grupoagrarius.com themasternoi.com wurdsspeledrong.com xn--diseafacil-w9a.com playtoown.shop butrikl.xyz amazonpublisherservice.com belihape.com ajaysilverpalace.in geredehanhotel.com cruises-11028.bond catering-57592.bond haloogi.com compasstransportaion.com 713952.site downloadfirekirin.xyz soapcoverr.store wellnesswomenassociation.com nortiapro.com trustedoakllc.info canadasimnigeria.com aiappsreviews.com dct15.com venenciadorapp.com | |||||||||||||||
| 6448 | /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\SysWOW64\cmd.exe | — | cmmon32.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6456 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6820 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6852 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (4472) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000701D6 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456C1F65C90855C6E4F8F2BAB2F396AD9A5 | |||
| (PID) Process: | (4472) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000701D6 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (1228) 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (1228) 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (1228) 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (1228) 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6340) cmmon32.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6340) cmmon32.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6340) cmmon32.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6340) cmmon32.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4472 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
| 1228 | 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | C:\Users\admin\AppData\Local\Temp\tmp6ACD.tmp | xml | |
MD5:893A1818242219356E16DB632C065537 | SHA256:CA418AACFD4B33DD10C488A14AADBCA3131B3911EC6BF51A951AEB24B9F37284 | |||
| 1228 | 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe | C:\Users\admin\AppData\Roaming\JdSqumW.exe | executable | |
MD5:CF4167C690383362C4B42AB32A0EE1BA | SHA256:48E036467595C63C65D8640A84F4BCF9545A20A9AC2596E8E555A4126C4E7CF7 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5632 | svchost.exe | GET | 200 | 2.21.97.24:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
5632 | svchost.exe | GET | 200 | 23.200.189.225:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
4680 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D | unknown | — | — | unknown |
5940 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
— | — | GET | 200 | 23.200.189.225:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
— | — | GET | 200 | 23.200.189.225:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
5860 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | unknown |
4472 | explorer.exe | GET | 301 | 13.56.33.8:80 | http://www.synive.com/dd20/?mxo4nn=w6AlLde&JnZ8Jf2=fKooi842jlwYaG+SLMb0qGZkMNvRIVNuq+3y1gjcEE5aV9oDsW7TcJNGfG1MW+MEsWIN | unknown | — | — | unknown |
4472 | explorer.exe | GET | 301 | 178.32.140.212:80 | http://www.checchintrasportilogistica.com/dd20/?JnZ8Jf2=Po+Mc9a0qsRAETI7+B0qC57OsDXSwWhDWxJiyxYFg1s2g1Tn9xzfBl6GBM7rcxi70IWh&mxo4nn=w6AlLde | unknown | — | — | unknown |
4472 | explorer.exe | GET | 200 | 15.197.148.33:80 | http://www.canadasimnigeria.com/dd20/?mxo4nn=w6AlLde&JnZ8Jf2=H6PmYu+FLW7w5tWpolc8OBbSN+QtMuUfVP+ngDlgbiTLcJglFHRUhUd3sYMo5MtJj8Vo | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4364 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
5632 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2384 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5140 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5632 | svchost.exe | 2.21.97.24:80 | crl.microsoft.com | Akamai International B.V. | SE | unknown |
5632 | svchost.exe | 23.200.189.225:80 | www.microsoft.com | Moratelindo Internet Exchange Point | ID | unknown |
4680 | SearchApp.exe | 184.31.15.137:443 | www.bing.com | Akamai International B.V. | SE | unknown |
4680 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5940 | svchost.exe | 40.126.32.76:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
r.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
4472 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
4472 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
4472 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |