File name:

8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe

Full analysis: https://app.any.run/tasks/d5a18083-b9d9-47ba-9b68-1d422e29f2e1
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: April 03, 2024, 11:50:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
formbook
xloader
stealer
spyware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

BFD671A9795F0D0396B0D0250317B93C

SHA1:

00F98B2FEDF06678E604B7E01A3C209F39602373

SHA256:

8466EBD92AA3FFCCBD00A4AA058FBFB9584F1DBDE6DF8D0670F2FD1D2DFC638D

SSDEEP:

24576:zSXFFpqYsfiKNkgM0PkYdrndhwNbnCdv5BwLQK9T0TdWgO4BWhwuOK5aAh3Fj:zSXFXqYsfiKNkgMWkYdrndhwNbCdv5ux

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe (PID: 1404)

    • FORMBOOK has been detected (YARA)

      • icacls.exe (PID: 2864)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 4780)

    • Actions looks like stealing of personal data

      • icacls.exe (PID: 2864)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe (PID: 1404)

    • Uses ICACLS.EXE to modify access control lists

      • explorer.exe (PID: 4780)

    • Deletes system .NET executable

      • icacls.exe (PID: 2864)

  • INFO

    • Checks supported languages

      • 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe (PID: 1404)
      • MSBuild.exe (PID: 4076)

    • Reads the computer name

      • 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe (PID: 1404)

    • Reads the machine GUID from the registry

      • 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe (PID: 1404)

    • Creates files or folders in the user directory

      • 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe (PID: 1404)

    • Manual execution by a user

      • icacls.exe (PID: 2864)

    • Reads security settings of Internet Explorer

      • icacls.exe (PID: 2864)

    • Create files in a temporary directory

      • icacls.exe (PID: 2864)

    • Checks proxy server information

      • slui.exe (PID: 2568)

    • Reads the software policy settings

      • slui.exe (PID: 2568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:02 03:07:39+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 773632
InitializedDataSize: 13824
UninitializedDataSize: -
EntryPoint: 0xbed6a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.2.0
ProductVersionNumber: 1.0.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Simulation Engine
CompanyName: Torus
FileDescription: SimulationEngine
FileVersion: 1.0.2.0
InternalName: iOjN.exe
LegalCopyright: Torus 2024
LegalTrademarks: -
OriginalFileName: iOjN.exe
ProductName: -
ProductVersion: 1.0.2.0
AssemblyVersion: 1.3.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe no specs msbuild.exe no specs #FORMBOOK icacls.exe slui.exe #FORMBOOK explorer.exe firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1404"C:\Users\admin\AppData\Local\Temp\8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe" C:\Users\admin\AppData\Local\Temp\8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe—explorer.exe
User:
admin
Company:
Torus
Integrity Level:
MEDIUM
Description:
SimulationEngine
Exit code:
0
Version:
1.0.2.0
Modules
Images
c:\users\admin\appdata\local\temp\8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2568C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
2864"C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
4076"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4780C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.1023 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
6420"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—icacls.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\msvcp140.dll
Total events
2 673
Read events
2 662
Write events
11
Delete events
0

Modification events

(PID) Process:(1404) 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1404) 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1404) 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1404) 8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2864) icacls.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2864) icacls.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2864) icacls.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
14048466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exeC:\Users\admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe.logtext
MD5:—
SHA256:—
2864icacls.exeC:\Users\admin\AppData\Local\Temp\dvvZj3l0binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
60
DNS requests
14
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6576
SIHClient.exe
GET
200
23.211.9.92:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6576
SIHClient.exe
GET
200
23.211.9.92:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
4780
explorer.exe
GET
404
174.138.177.173:80
http://www.elysiangame.online/bnz5/?W-6O1=4BEdEKurUNEFwkFRYxSpDzCnjD7vF8T0kB0gdoDHo+aBzggPclQDQJqF4ehpSB3lBDvuZzIzoYk2h0Zy/GWQVR67cuM+Hu6snJpVttPBcju6qLxvykCdmNisoqNiN3rZ49c+8fA=&UUy9=xSMNdw
unknown
—
—
unknown
3996
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4288
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
4780
explorer.exe
POST
—
91.195.240.117:80
http://www.blueberry-breeze.com/bnz5/
unknown
—
—
unknown
4780
explorer.exe
POST
405
91.195.240.117:80
http://www.blueberry-breeze.com/bnz5/
unknown
—
—
unknown
4780
explorer.exe
POST
405
91.195.240.117:80
http://www.blueberry-breeze.com/bnz5/
unknown
—
—
unknown
4780
explorer.exe
POST
405
91.195.240.117:80
http://www.blueberry-breeze.com/bnz5/
unknown
—
—
unknown
4780
explorer.exe
GET
436
91.195.240.117:80
http://www.blueberry-breeze.com/bnz5/?W-6O1=Z7N7hXY/vxItmyrXLBxSJENEOwntEI4/X1tSw0B7uFqoJtXe6IwXeXQiXEM/Xr4/ado0xvKOz5lKhVT9TZmVF2fgGbYSAx6pRun90UtIcflvwcYwBUO/jumcrHdCbnEhcQIfQdU=&UUy9=xSMNdw
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4828
svchost.exe
239.255.255.250:1900
—
—
—
unknown
6124
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3996
svchost.exe
20.190.159.64:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1280
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3996
svchost.exe
20.190.159.4:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3996
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6576
SIHClient.exe
40.127.169.103:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6576
SIHClient.exe
23.211.9.92:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6576
SIHClient.exe
20.242.39.171:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4288
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 23.211.9.92
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.elysiangame.online
  • 174.138.177.173
unknown
www.blueberry-breeze.com
  • 91.195.240.117
unknown
www.collegeclubapparel.com
  • 91.195.240.117
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
4780
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8466ebd92aa3ffccbd00a4aa058fbfb9584f1dbde6df8d0670f2fd1d2dfc638d.exe