| File name: | PAYMENT ERROR.exe |
| Full analysis: | https://app.any.run/tasks/353912fd-2e6e-408b-bda0-ccba4c8be84f |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | August 07, 2024, 16:34:33 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows |
| MD5: | 3D93AD3D9374E100842FC9A5C683D86B |
| SHA1: | 6D84040392C2B071DD1546A85CE7C8F527D7E1B3 |
| SHA256: | 8AC8568934D1A0AB9A9923449BF11C0D44D97ABCA0BCABD60B94348642F046AC |
| SSDEEP: | 49152:RD3bZMoA/b7m+9H8UEqWl4HVl4128WivlOd1Hd6P7uMG:R3f0OiH8UEG343kJ4y |
MALICIOUS
Drops the executable file immediately after the start
- PAYMENT ERROR.exe (PID: 6440)
FORMBOOK has been detected (YARA)
- netsh.exe (PID: 6728)
Connects to the CnC server
- explorer.exe (PID: 4552)
FORMBOOK has been detected (SURICATA)
- explorer.exe (PID: 4552)
SUSPICIOUS
Executes application which crashes
- PAYMENT ERROR.exe (PID: 6440)
Deletes system .NET executable
- cmd.exe (PID: 6884)
Suspicious use of NETSH.EXE
- explorer.exe (PID: 4552)
Starts CMD.EXE for commands execution
- netsh.exe (PID: 6728)
Contacting a server suspected of hosting an CnC
- explorer.exe (PID: 4552)
INFO
Checks supported languages
- PAYMENT ERROR.exe (PID: 6440)
- ngen.exe (PID: 6540)
Reads the machine GUID from the registry
- PAYMENT ERROR.exe (PID: 6440)
Manual execution by a user
- netsh.exe (PID: 6728)
Checks proxy server information
- WerFault.exe (PID: 6708)
Reads the software policy settings
- WerFault.exe (PID: 6708)
Creates files or folders in the user directory
- WerFault.exe (PID: 6708)
Reads the computer name
- ngen.exe (PID: 6540)
- PAYMENT ERROR.exe (PID: 6440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(6728) netsh.exe
C2www.selalujadipemenang.com/oi12/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
f-end
Decoy C2 (64)exobello.bio
boinga.xyz
animasriversurf.com
gamesflashg.com
hayatbagievleri.online
washington-living.com
july7.store
x-pod-technologies.com
farmhouseflaire.com
qb52aa.top
datasynthing.xyz
5v28n.rest
legacycommerceltd.com
mundodelosjuguetes.com
wjblades.com
z9b6g8.com
eskimotech.net
dreziuy.xyz
bestsolarcompanies.services
vertemisconsulting.com
rockinrioviagogo.com
acimed.net
tdrfwb.shop
xd4tp.top
bihungoreng19.click
tcnhbv301y.top
triumphbusinessconsultancy.com
menuconfig.store
seikoubento.com
defiram.com
bespokearomatics.com
yellprint.com
flickeringlc.christmas
aidiagnostics.xyz
ok66g.app
z3o6i8.com
dacoylomarkemilcajes.online
rummymeett.xyz
arazivearsa.xyz
crystalpalaces.store
qtsandbox.com
wkbbb.com
abusedcode.com
puzzle-escape.info
jagoboss.com
seguro-pagamento.life
luxindicator.site
mxtp.coffee
okumafishing.xyz
gaffelshop.shop
optimusgs.com
qtsandbox.com
bt365332.com
kernphoto.art
p0uhx.pro
agsaydinlatma.online
korbidholdings.net
nsservicescorp.com
healthcare-trends-22748.bond
xtraslot.link
travelblitarjuandabmtrans.com
linlinda.com
gnonhcav.xyz
05544.xyz
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:08:05 16:16:25+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 48 |
| CodeSize: | 21154 |
| InitializedDataSize: | 2560 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x0000 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 4.30.497.82 |
| ProductVersionNumber: | 4.30.497.82 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | Obiwaququboqoposuq |
| ProductName: | Osokiwilogi |
| FileDescription: | Axejagewi Ocudazapunotoy Azezewofe Uvovarudakomac Iwucike. |
| FileVersion: | 4.30.497.82 |
| ProductVersion: | 4.30.497.82 |
| OriginalFileName: | Onozupocen |
| InternalName: | Eqihefejija |
| LegalCopyright: | © 2027 Obiwaququboqoposuq |
Total processes
137
Monitored processes
9
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2256 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4552 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6440 | "C:\Users\admin\AppData\Local\Temp\PAYMENT ERROR.exe" | C:\Users\admin\AppData\Local\Temp\PAYMENT ERROR.exe | explorer.exe | ||||||||||||
User: admin Company: Obiwaququboqoposuq Integrity Level: MEDIUM Description: Axejagewi Ocudazapunotoy Azezewofe Uvovarudakomac Iwucike. Exit code: 3762504530 Version: 4.30.497.82 Modules
| |||||||||||||||
| 6448 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | PAYMENT ERROR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6540 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe | — | PAYMENT ERROR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Common Language Runtime native compiler Exit code: 0 Version: 4.8.9093.0 built by: NET481REL1LAST_C Modules
| |||||||||||||||
| 6708 | C:\WINDOWS\system32\WerFault.exe -u -p 6440 -s 1148 | C:\Windows\System32\WerFault.exe | PAYMENT ERROR.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6728 | "C:\Windows\SysWOW64\netsh.exe" | C:\Windows\SysWOW64\netsh.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
Formbook(PID) Process(6728) netsh.exe C2www.selalujadipemenang.com/oi12/ Strings (79)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start f-end Decoy C2 (64)exobello.bio boinga.xyz animasriversurf.com gamesflashg.com hayatbagievleri.online washington-living.com july7.store x-pod-technologies.com farmhouseflaire.com qb52aa.top datasynthing.xyz 5v28n.rest legacycommerceltd.com mundodelosjuguetes.com wjblades.com z9b6g8.com eskimotech.net dreziuy.xyz bestsolarcompanies.services vertemisconsulting.com rockinrioviagogo.com acimed.net tdrfwb.shop xd4tp.top bihungoreng19.click tcnhbv301y.top triumphbusinessconsultancy.com menuconfig.store seikoubento.com defiram.com bespokearomatics.com yellprint.com flickeringlc.christmas aidiagnostics.xyz ok66g.app z3o6i8.com dacoylomarkemilcajes.online rummymeett.xyz arazivearsa.xyz crystalpalaces.store qtsandbox.com wkbbb.com abusedcode.com puzzle-escape.info jagoboss.com seguro-pagamento.life luxindicator.site mxtp.coffee okumafishing.xyz gaffelshop.shop optimusgs.com qtsandbox.com bt365332.com kernphoto.art p0uhx.pro agsaydinlatma.online korbidholdings.net nsservicescorp.com healthcare-trends-22748.bond xtraslot.link travelblitarjuandabmtrans.com linlinda.com gnonhcav.xyz 05544.xyz | |||||||||||||||
| 6884 | /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" | C:\Windows\SysWOW64\cmd.exe | — | netsh.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6892 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
6 447
Read events
6 445
Write events
1
Delete events
1
Modification events
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000502F0 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456033BCEE44DE41B4E8AEC331E84F566D2 | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000502F0 |
| Operation: | delete key | Name: | (default) |
Value: | |||
Executable files
0
Suspicious files
3
Text files
2
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6708 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_PAYMENT ERROR.ex_8729092a584363c94d8f2b2641526124fdd4b5_e91a3f7f_4f0b6c47-1446-4b0e-85ed-eeb17e8f4c4a\Report.wer | — | |
MD5:— | SHA256:— | |||
| 6708 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\PAYMENT ERROR.exe.6440.dmp | — | |
MD5:— | SHA256:— | |||
| 6708 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER79A1.tmp.WERInternalMetadata.xml | xml | |
MD5:7A67018F6DB6167EEBAA3DA2DF710906 | SHA256:5961951B4476C0ABD4C9BA35701807DAC514499632E147A5F4ECBC1D664AE7B0 | |||
| 4552 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
| 6708 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER77DB.tmp.dmp | dmp | |
MD5:DE72AC5022B17DD34B000A200EA18BB8 | SHA256:8E69DBAF56F2D275FE8A4F9B7F15B4B5A05B772B3FAA473E7BBFB6FFCB1EB476 | |||
| 6708 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER79E1.tmp.xml | xml | |
MD5:E7038CCD2BC9E595399A4A1A9D0A3F29 | SHA256:148F781096191791C1B790D5AD918D9C3CEC9F15749B7C9CA6CE09908B5C281F | |||
| 6708 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE | binary | |
MD5:FB64A9EBEDF48D3895381D5B7D80743D | SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42 | |||
| 6708 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785 | binary | |
MD5:82C30E45BF5F93A5DB1D5E47F913053B | SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
45
DNS requests
22
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
4544 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4544 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7100 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
4552 | explorer.exe | GET | 301 | 185.63.191.68:80 | http://www.gamesflashg.com/oi12/?YvPh6=Plb0srchS&tPRL3=eIuv3wZ2kp79JIs6jXRb5Lgy0+pj2kePTydLRKTXyGZHt1Ci7GFXkH70HW6SDNwiD6RB | unknown | — | — | whitelisted |
7084 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
4552 | explorer.exe | GET | 530 | 206.119.185.133:80 | http://www.05544.xyz/oi12/?tPRL3=VEG9pKblbsgSnCWsGKPKP1Hmb05x3B62Vvzf8wp10Gf5CfmNDoWnnzfTrf2vfBElSOBL&YvPh6=Plb0srchS | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1248 | RUXIMICS.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1224 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1224 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6708 | WerFault.exe | 20.42.65.92:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
5336 | SearchApp.exe | 104.126.37.170:443 | www.bing.com | Akamai International B.V. | DE | unknown |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
4552 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
4552 | explorer.exe | Potentially Bad Traffic | ET HUNTING Request to .XYZ Domain with Minimal Headers |
4552 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |