| File name: | P.O.exe |
| Full analysis: | https://app.any.run/tasks/07f8b2e4-f1d8-4ca9-a0ff-415a74ac82f6 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | March 24, 2025, 05:51:19 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 3FF401F9D2A80CD5ACA0593B933FF34C |
| SHA1: | DD93283234EFDCDE49586F891C6FD4675634DE5F |
| SHA256: | 7308C76E724C775BC44E6C3AB076F564C1B8A5E4A51F5DBD97E316763A08DA5F |
| SSDEEP: | 49152:ue6d1xPOcm3caEUadI1npPIToUjj1UVKh5XkVIzsSR7O+CRNvT8PkAwB:Z3cld6dU6Vk5Xk+5q+Cr3Aw |
MALICIOUS
FORMBOOK has been detected
- msiexec.exe (PID: 1764)
- explorer.exe (PID: 5492)
FORMBOOK has been detected (YARA)
- msiexec.exe (PID: 1764)
Connects to the CnC server
- explorer.exe (PID: 5492)
FORMBOOK has been detected (SURICATA)
- explorer.exe (PID: 5492)
SUSPICIOUS
Application launched itself
- P.O.exe (PID: 5428)
Starts CMD.EXE for commands execution
- msiexec.exe (PID: 1764)
Contacting a server suspected of hosting an CnC
- explorer.exe (PID: 5492)
INFO
.NET Reactor protector has been detected
- P.O.exe (PID: 5428)
Checks supported languages
- P.O.exe (PID: 1056)
- P.O.exe (PID: 5428)
Reads the machine GUID from the registry
- P.O.exe (PID: 5428)
Manual execution by a user
- msiexec.exe (PID: 1764)
Reads the computer name
- P.O.exe (PID: 1056)
- P.O.exe (PID: 5428)
Reads the software policy settings
- slui.exe (PID: 6480)
- slui.exe (PID: 4424)
Checks proxy server information
- slui.exe (PID: 4424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(1764) msiexec.exe
C2www.ncintura.com/cx01/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
f-end
Decoy C2 (64)bkudelivery.com
canaldeaprendizaje.online
reshapeaestheics.co.uk
6623max.com
huachunjianshe-sh.com
evenmore.live
ceceloa.com
bellysouth.net
vivianivcfl.com
2023ee.com
vlorarestaurant.uk
learngerman.cyou
fejkus.xyz
nolimitpaintingllc.net
kerigmaauditores.com
hzairt.cfd
ikincielbeyazesyam.click
efeftrust.buzz
bargainhills.com
derryautoparts.com
finspace.biz
lakejacksonmoderndentistry.net
lqrpfp.com
desains.net
bm9222.com
globaltrustcapitalcorp.shop
citar.win
artwithstories.com
36205122222.xyz
cuiligandiy.com
binarymrktltd.com
financeclub.net
cabeloss.online
davshop.africa
duffels-shop.com
greepeas.com
igaoman.com
snau-ovwx.net
kar-phi.shop
221553.com
fortreaclinicaltrials.com
cgft21zreh8wb6i.buzz
51choujiang.net
goodd88.com
eyeppy.net
wearsidesmallholders.org.uk
freshenu.com
51cg6.xyz
circlemail-uma.com
ldkj9kk.vip
ledtracklights.shop
55402vip.com
fecoles.online
dakshiniswad.com
marrvision.com
lihtcsolar.com
dcvbrfervcewfeg.click
hpfse.bond
themidnightseries.net
digitalnishant.com
providerastro.com
uniproh.africa
keepbritainpouring.com
ahxsj.net
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (55.8) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21) |
| .scr | | | Windows screen saver (9.9) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2069:04:11 14:54:33+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 1037824 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xff4ce |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | Electronic Arts |
| FileDescription: | EAConnect |
| FileVersion: | 1.0.0.0 |
| InternalName: | aHoruTR.exe |
| LegalCopyright: | Copyright © 2020 |
| LegalTrademarks: | - |
| OriginalFileName: | aHoruTR.exe |
| ProductName: | EAConnect |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
152
Monitored processes
10
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1056 | "C:\Users\admin\AppData\Local\Temp\P.O.exe" | C:\Users\admin\AppData\Local\Temp\P.O.exe | — | P.O.exe | |||||||||||
User: admin Company: Electronic Arts Integrity Level: MEDIUM Description: EAConnect Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1188 | /c del "C:\Users\admin\AppData\Local\Temp\P.O.exe" | C:\Windows\SysWOW64\cmd.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1764 | "C:\Windows\SysWOW64\msiexec.exe" | C:\Windows\SysWOW64\msiexec.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
Formbook(PID) Process(1764) msiexec.exe C2www.ncintura.com/cx01/ Strings (79)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start f-end Decoy C2 (64)bkudelivery.com canaldeaprendizaje.online reshapeaestheics.co.uk 6623max.com huachunjianshe-sh.com evenmore.live ceceloa.com bellysouth.net vivianivcfl.com 2023ee.com vlorarestaurant.uk learngerman.cyou fejkus.xyz nolimitpaintingllc.net kerigmaauditores.com hzairt.cfd ikincielbeyazesyam.click efeftrust.buzz bargainhills.com derryautoparts.com finspace.biz lakejacksonmoderndentistry.net lqrpfp.com desains.net bm9222.com globaltrustcapitalcorp.shop citar.win artwithstories.com 36205122222.xyz cuiligandiy.com binarymrktltd.com financeclub.net cabeloss.online davshop.africa duffels-shop.com greepeas.com igaoman.com snau-ovwx.net kar-phi.shop 221553.com fortreaclinicaltrials.com cgft21zreh8wb6i.buzz 51choujiang.net goodd88.com eyeppy.net wearsidesmallholders.org.uk freshenu.com 51cg6.xyz circlemail-uma.com ldkj9kk.vip ledtracklights.shop 55402vip.com fecoles.online dakshiniswad.com marrvision.com lihtcsolar.com dcvbrfervcewfeg.click hpfse.bond themidnightseries.net digitalnishant.com providerastro.com uniproh.africa keepbritainpouring.com ahxsj.net | |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4424 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4988 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5112 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5428 | "C:\Users\admin\AppData\Local\Temp\P.O.exe" | C:\Users\admin\AppData\Local\Temp\P.O.exe | — | explorer.exe | |||||||||||
User: admin Company: Electronic Arts Integrity Level: MEDIUM Description: EAConnect Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 5492 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6480 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
7 382
Read events
7 380
Write events
2
Delete events
0
Modification events
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}.check.800 |
| Operation: | write | Name: | CheckSetting |
Value: 23004100430042006C006F0062000000000000000100000080000000FC7F0000F218B348819CDB01000000007B00440045003700420032003400450041002D0037003300430038002D0034004100300039002D0039003800350044002D003500420044004100440043004600410039003000310037007D002E006E006F00740069006600690063006100740069006F006E002E00320000000000000000000000000000 | |||
| (PID) Process: | (5492) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}.check.800 |
| Operation: | write | Name: | CheckSetting |
Value: 23004100430042006C006F0062000000000000000000000001000000740065006D000000 | |||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
71
DNS requests
26
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5492 | explorer.exe | GET | 404 | 104.21.43.179:80 | http://www.duffels-shop.com/cx01/?9rv8HjP=A8Y5k1Ilcx5SuBKErqdKz6s9SZo5aD2Z6R/20YHelyd9XWRzAjv9bVWd8irAuzOi1FYM&HnYlQx=qXz8J6 | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 64.98.135.100:80 | http://www.lakejacksonmoderndentistry.net/cx01/?HnYlQx=qXz8J6&9rv8HjP=WAaU0MHPiwL7PYncowBUUsPpJ9AmH25OLsSRfkX6NtsW7jSkMsEnjzUCyMr9lGP+0LDa | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.desains.net/cx01/?9rv8HjP=Y5BanVxQ+mtRS2uNYgTLrMsXOn+Kx0quepLNVLoguarAU9wLdlx5Wgd4sUklyllu/XYR&HnYlQx=qXz8J6 | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.eyeppy.net/cx01/?9rv8HjP=bHOpW57/Ip9T5uUEa8Cr/oAW2TZApcvHvrvNmHoHFMk5GnrdzVvWUcZ8SUzJyg6KcDmN&HnYlQx=qXz8J6 | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.greepeas.com/cx01/?HnYlQx=qXz8J6&9rv8HjP=//0XTgE6TegAt23Oc7we15vz1P75NqkDN3VEfDSZ5tRraUJWnDb5+ymmCSqVfCGBvse7 | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.ledtracklights.shop/cx01/?HnYlQx=qXz8J6&9rv8HjP=cdkqBSPSrBbOxREPEw/TJSZyO/y/3/6aXDhftHPyNWfqzd9QApCjtUBgaz03j1ojHRCz | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.davshop.africa/cx01/?HnYlQx=qXz8J6&9rv8HjP=/xkFdh4txMSrM20KKtYtgUNZPIwYBhGbpMA4rwD8Nyarvs1D3ec6f8Nbg0BO9crqpfX9 | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.ncintura.com/cx01/?9rv8HjP=asFrVbVwaO7oO0vfDn/1V1mZ70zoqoFUtmZc7WenXo8RpytrAevRvePPAV4CAhOTFgsf&HnYlQx=qXz8J6 | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 49.13.77.253:80 | http://www.cgft21zreh8wb6i.buzz/cx01/?9rv8HjP=1NiUsJ5Xql8aY4APpnVzeFZ3Ih1qDrEOR6iXUvl/FNQcuVdDvkkDJSaiyxPjDZWZMy7n&HnYlQx=qXz8J6 | unknown | — | — | malicious |
5492 | explorer.exe | GET | 404 | 23.227.38.74:80 | http://www.bargainhills.com/cx01/?HnYlQx=qXz8J6&9rv8HjP=HPpIH7If2ulQh8ub0GADI1sOaQOLfLanDtjmU1IMhCPPfmmeRiP8ACSMITb8sCR4lD+U | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6480 | slui.exe | 40.91.76.224:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5492 | explorer.exe | 64.98.135.100:80 | www.lakejacksonmoderndentistry.net | AS-TING-BACKBONE | US | malicious |
3216 | svchost.exe | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
www.lakejacksonmoderndentistry.net |
| malicious |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.duffels-shop.com |
| malicious |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.buzz domain |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |