File name:

DHL customer form and parcel details.exe

Full analysis: https://app.any.run/tasks/8ee0301f-1ecc-46a7-9f04-8077c6ebdbc6
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: November 23, 2023, 12:50:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
formbook
xloader
stealer
spyware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

928BEBB9E1B55B7B5DFCE8AD0958C6F4

SHA1:

CDBC528DB55CB888D0892D346805B80215D44419

SHA256:

4E888A7A812BE647C1DB3C45B41997976B81FCAC54DBB3C2C53087518C036287

SSDEEP:

49152:IuWr6vmvVIGbphHdf8zZIp8GC/Sj1DMQiB5NTFgQWO+Dd7HzA:tWr6vmtbpEzZ5Q8B5NNWzA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK has been detected (YARA)

      • wininit.exe (PID: 1728)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Connects to the CnC server

      • explorer.exe (PID: 1944)

  • SUSPICIOUS

    • Application launched itself

      • DHL customer form and parcel details.exe (PID: 2584)

    • Starts CMD.EXE for commands execution

      • wininit.exe (PID: 1728)

  • INFO

    • Reads the computer name

      • DHL customer form and parcel details.exe (PID: 2584)
      • DHL customer form and parcel details.exe (PID: 572)

    • Checks supported languages

      • DHL customer form and parcel details.exe (PID: 2584)
      • DHL customer form and parcel details.exe (PID: 572)

    • Manual execution by a user

      • autoconv.exe (PID: 2380)
      • autoconv.exe (PID: 1696)
      • autoconv.exe (PID: 284)
      • autoconv.exe (PID: 308)
      • autoconv.exe (PID: 976)
      • autoconv.exe (PID: 2228)
      • wininit.exe (PID: 1728)

    • Reads the machine GUID from the registry

      • DHL customer form and parcel details.exe (PID: 2584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(1728) wininit.exe
C2www.archernoob.com/sy13/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)shophouseoftrinh.com
xn--i9q20pc9dov6e.com
kconevent.com
qqcghjb.shop
huirushi.com
havesat.com
5201314.fan
agroyouth.com
mertking1017.com
cled.online
825symphony.com
nutvc.com
solarenergy-price.live
brinhos.online
sexonlinedir.com
slotonlinegacorwin.com
tsescort.beauty
performantcap.com
drmatheusrodrigues.com
oxfighter.com
growersharv.best
trxioc.xyz
bajubo.cloud
afminok.com
natashatrocel.com
islotjackpot.com
nikindiansexxnxx.com
novezzi.com
vinoandvibeslounge.com
lawyerbraincoaching.com
leftinruin.com
lemonadefromlimes.com
7pw.xyz
hemaponction.com
youmunet.com
glamynov.com
rerescardshop.online
yxjdfyt.com
bety8.com
kuajing.icu
matzalal.com
tropadok10.com
masukslotgacor.club
quanzhiai.com
d5m3gw87t2.skin
sandymeyerremax.com
renda.digital
1325817.com
kieranlchadwick.xyz
cgv85.com
dekonlinuk.com
localmawes.top
benzo-pila.store
amjszk0.top
purplesplace.com
hu166.com
lirab-coin.com
dvds4x4.com
112233.store
fxbrokersnews.com
savecoco.com
86lode88.vip
the682group.com
tudoverso.store
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:23 01:38:25+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 1092608
InitializedDataSize: 39936
UninitializedDataSize: -
EntryPoint: 0x10cb62
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Flexible_computing
FileVersion: 1.0.0.*
InternalName: CSvti.exe
LegalCopyright: Copyright © 2011-2012
LegalTrademarks: -
OriginalFileName: CSvti.exe
ProductName: Flexible_computing
ProductVersion: 1.0.0.*
AssemblyVersion: 3.35.0.6552
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dhl customer form and parcel details.exe no specs dhl customer form and parcel details.exe no specs autoconv.exe no specs autoconv.exe no specs autoconv.exe no specs autoconv.exe no specs autoconv.exe no specs autoconv.exe no specs #FORMBOOK wininit.exe no specs cmd.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
284"C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autoconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
308"C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autoconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
572"C:\Users\admin\AppData\Local\Temp\DHL customer form and parcel details.exe"C:\Users\admin\AppData\Local\Temp\DHL customer form and parcel details.exe—DHL customer form and parcel details.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Flexible_computing
Exit code:
0
Version:
1.0.0.*
Modules
Images
c:\users\admin\appdata\local\temp\dhl customer form and parcel details.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
976"C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autoconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1696"C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autoconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1728"C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Start-Up Application
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\wininit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Formbook
(PID) Process(1728) wininit.exe
C2www.archernoob.com/sy13/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)shophouseoftrinh.com
xn--i9q20pc9dov6e.com
kconevent.com
qqcghjb.shop
huirushi.com
havesat.com
5201314.fan
agroyouth.com
mertking1017.com
cled.online
825symphony.com
nutvc.com
solarenergy-price.live
brinhos.online
sexonlinedir.com
slotonlinegacorwin.com
tsescort.beauty
performantcap.com
drmatheusrodrigues.com
oxfighter.com
growersharv.best
trxioc.xyz
bajubo.cloud
afminok.com
natashatrocel.com
islotjackpot.com
nikindiansexxnxx.com
novezzi.com
vinoandvibeslounge.com
lawyerbraincoaching.com
leftinruin.com
lemonadefromlimes.com
7pw.xyz
hemaponction.com
youmunet.com
glamynov.com
rerescardshop.online
yxjdfyt.com
bety8.com
kuajing.icu
matzalal.com
tropadok10.com
masukslotgacor.club
quanzhiai.com
d5m3gw87t2.skin
sandymeyerremax.com
renda.digital
1325817.com
kieranlchadwick.xyz
cgv85.com
dekonlinuk.com
localmawes.top
benzo-pila.store
amjszk0.top
purplesplace.com
hu166.com
lirab-coin.com
dvds4x4.com
112233.store
fxbrokersnews.com
savecoco.com
86lode88.vip
the682group.com
tudoverso.store
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2228"C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autoconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2380"C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autoconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2584"C:\Users\admin\AppData\Local\Temp\DHL customer form and parcel details.exe" C:\Users\admin\AppData\Local\Temp\DHL customer form and parcel details.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Flexible_computing
Exit code:
0
Version:
1.0.0.*
Modules
Images
c:\users\admin\appdata\local\temp\dhl customer form and parcel details.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
Total events
124
Read events
115
Write events
9
Delete events
0

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(1944) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
3
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
explorer.exe
GET
302
81.17.29.149:80
http://www.dekonlinuk.com/sy13/?rDHph=jnjhjcAL3L3LEH7HDpbHMBiBAde9u5PprO3que0wFEYtZi+n1NRUGmBuW/+numej8qVv1A==&Wr=LhnLHroPV
unknown
text
11 b
unknown
1944
explorer.exe
GET
404
162.240.81.18:80
http://www.tudoverso.store/sy13/?rDHph=RXytQUAqLYmpVTNBsPWEqG/5jLA9k6Hr/TwQx+ILM2c6JmUeD9O7BqXB6Z5liNqrJRBPPA==&Wr=LhnLHroPV
unknown
html
3.56 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1944
explorer.exe
81.17.29.149:80
www.dekonlinuk.com
Private Layer INC
CH
unknown
1944
explorer.exe
162.240.81.18:80
www.tudoverso.store
UNIFIEDLAYER-AS-1
US
unknown

DNS requests

Domain
IP
Reputation
www.dekonlinuk.com
  • 81.17.29.149
unknown
www.mertking1017.com
  • —
unknown
www.tudoverso.store
  • 162.240.81.18
unknown

Threats

PID
Process
Class
Message
1944
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DHL customer form and parcel details.exe