analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | f6f4429e20b9926d303588a31653453a |
| Full analysis: | https://app.any.run/tasks/cd532e23-198f-46bb-9cdf-f22e2777b661 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | May 20, 2022, 17:01:33 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | F6F4429E20B9926D303588A31653453A |
| SHA1: | 86F9D96BE5DCB3933F10A6ED2C3A458E1CA5E86B |
| SHA256: | 9F72653C6D0D21058DCC6DD9ABBA18630FF76B15856C9BC163AAC90FE1192F65 |
| SSDEEP: | 6144:B0YA05WmkB4/6J2wFnh7xkFq2tnNbhdIsA:tvkm6RnVxGtFgH |
MALICIOUS
Drops executable file immediately after starts
- f6f4429e20b9926d303588a31653453a.exe (PID: 2924)
Application was dropped or rewritten from another process
- ejwun.exe (PID: 3808)
- ejwun.exe (PID: 2844)
FORMBOOK detected by memory dumps
- control.exe (PID: 2264)
Connects to CnC server
- Explorer.EXE (PID: 1296)
FORMBOOK was detected
- Explorer.EXE (PID: 1296)
SUSPICIOUS
Checks supported languages
- ejwun.exe (PID: 3808)
- f6f4429e20b9926d303588a31653453a.exe (PID: 2924)
- ejwun.exe (PID: 2844)
Reads the computer name
- f6f4429e20b9926d303588a31653453a.exe (PID: 2924)
- ejwun.exe (PID: 3808)
Application launched itself
- ejwun.exe (PID: 2844)
Executable content was dropped or overwritten
- f6f4429e20b9926d303588a31653453a.exe (PID: 2924)
Drops a file with a compile date too recent
- f6f4429e20b9926d303588a31653453a.exe (PID: 2924)
Starts CMD.EXE for commands execution
- control.exe (PID: 2264)
Reads Environment values
- control.exe (PID: 2264)
INFO
Manual execution by user
- autofmt.exe (PID: 1736)
- control.exe (PID: 2264)
Reads the computer name
- control.exe (PID: 2264)
Checks supported languages
- cmd.exe (PID: 3552)
- control.exe (PID: 2264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | NSIS - Nullsoft Scriptable Install System (94.8) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (3.4) |
| .dll | | | Win32 Dynamic Link Library (generic) (0.7) |
| .exe | | | Win32 Executable (generic) (0.5) |
| .exe | | | Generic Win/DOS Executable (0.2) |
EXIF
EXE
| Subsystem: | Windows GUI |
|---|---|
| SubsystemVersion: | 4 |
| ImageVersion: | - |
| OSVersion: | 4 |
| EntryPoint: | 0x32fa |
| UninitializedDataSize: | 1024 |
| InitializedDataSize: | 119808 |
| CodeSize: | 23040 |
| LinkerVersion: | 6 |
| PEType: | PE32 |
| TimeStamp: | 2007:06:08 23:48:38+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 08-Jun-2007 21:48:38 |
| Detected languages: |
|
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000D8 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 08-Jun-2007 21:48:38 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x000059AC | 0x00005A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.45808 |
.rdata | 0x00007000 | 0x0000117A | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.17514 |
.data | 0x00009000 | 0x0001AFD8 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.98111 |
.ndata | 0x00024000 | 0x00008000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x0002C000 | 0x00000900 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.94449 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.00226 | 491 | UNKNOWN | English - United States | RT_MANIFEST |
103 | 2.16096 | 20 | UNKNOWN | English - United States | RT_GROUP_ICON |
105 | 2.66174 | 256 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.88094 | 284 | UNKNOWN | English - United States | RT_DIALOG |
111 | 2.48825 | 96 | UNKNOWN | English - United States | RT_DIALOG |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
ole32.dll |
Total processes
40
Monitored processes
7
Malicious processes
3
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2924 | "C:\Users\admin\AppData\Local\Temp\f6f4429e20b9926d303588a31653453a.exe" | C:\Users\admin\AppData\Local\Temp\f6f4429e20b9926d303588a31653453a.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2844 | C:\Users\admin\AppData\Local\Temp\ejwun.exe C:\Users\admin\AppData\Local\Temp\zzibob | C:\Users\admin\AppData\Local\Temp\ejwun.exe | — | f6f4429e20b9926d303588a31653453a.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3808 | C:\Users\admin\AppData\Local\Temp\ejwun.exe C:\Users\admin\AppData\Local\Temp\zzibob | C:\Users\admin\AppData\Local\Temp\ejwun.exe | — | ejwun.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 1736 | "C:\Windows\System32\autofmt.exe" | C:\Windows\System32\autofmt.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Auto File System Format Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2264 | "C:\Windows\System32\control.exe" | C:\Windows\System32\control.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Control Panel Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3552 | /c del "C:\Users\admin\AppData\Local\Temp\ejwun.exe" | C:\Windows\System32\cmd.exe | — | control.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1296 | C:\Windows\Explorer.EXE | C:\Windows\Explorer.EXE | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 043
Read events
1 023
Write events
20
Delete events
0
Modification events
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2264) control.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47} |
| Operation: | write | Name: | WpadDecisionReason |
Value: 1 | |||
Executable files
1
Suspicious files
3
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2924 | f6f4429e20b9926d303588a31653453a.exe | C:\Users\admin\AppData\Local\Temp\nsp912C.tmp | binary | |
MD5:37F4E74943B29F9FA1F3C831192F4103 | SHA256:93ABE31F20E031CDDC59D38D985CA829D76AA6A9C03E74C11B6A4680CCC53F77 | |||
| 2924 | f6f4429e20b9926d303588a31653453a.exe | C:\Users\admin\AppData\Local\Temp\zzibob | binary | |
MD5:C7D1A7DCD761F8A5E735A5D8DE5CE547 | SHA256:C522D8F12D1C90109CE5CC1AD869EB686AC41B5FFE39389A5A69D988AF49309A | |||
| 2924 | f6f4429e20b9926d303588a31653453a.exe | C:\Users\admin\AppData\Local\Temp\mh85m2jv6e0uv | binary | |
MD5:41B976D1718518D5F46777DACB9DA0EA | SHA256:1FF5B305B9378EDF61B2F49D1FEA641BEED283072206EBD5EBF8073353F4B5DC | |||
| 2924 | f6f4429e20b9926d303588a31653453a.exe | C:\Users\admin\AppData\Local\Temp\ejwun.exe | executable | |
MD5:3DFDF023601255AD791B7EBE905DEE39 | SHA256:10E45C740358F7AB0BDD64872E335D985346B43B249AF8CC5AC5EC05E8AEA014 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
14
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1296 | Explorer.EXE | GET | 301 | 172.67.177.150:80 | http://www.madetopraisehim.com/ud5f/?op=a2ov3UetN5saYEcMy3VOfn4wiHyDLnGbya3pXdBlwkz2ufKL6Uy4REPBuLH13gZ8oeMQiQ==&EDfLe=ChTpWThHeb7D_ | US | — | — | malicious |
1296 | Explorer.EXE | GET | — | 198.54.117.218:80 | http://www.marmolsystem.com/ud5f/?op=0MSSJ9hUIs7PgjJ3+mk+0zzhE8z5E1jXJW74SnlQrHocPnkzWTEgArIB4bkSCGhZ9wx38Q==&EDfLe=ChTpWThHeb7D_ | US | — | — | malicious |
1296 | Explorer.EXE | GET | — | 76.164.193.180:80 | http://www.dadagrin.com/ud5f/?op=dWuefBw2Ca+m6zNRkdXQ0lLKDfUlac+jIHPH1PIwrJ3GytoNrVAPJuRm+tOEV78AnbR55Q==&EDfLe=ChTpWThHeb7D_ | US | — | — | malicious |
1296 | Explorer.EXE | GET | 301 | 66.96.160.152:80 | http://www.freerenoadvice.com/ud5f/?op=/TToMDCW3nUhJZDNRFT2wMaIAe2sglICrt5t2dOu5wDbuzlS1GgQ+IGCyTEzDolJIX8l2w==&EDfLe=ChTpWThHeb7D_ | US | html | 344 b | malicious |
1296 | Explorer.EXE | GET | 302 | 3.18.7.81:80 | http://www.recordanalytics.com/ud5f/?op=p5jtgtcmtmGScIUiU557GAe+uAZg7cHJGY2RA0vgTIZ7xvoPGXOR5tzAcyJtgw5tGZf26A==&EDfLe=ChTpWThHeb7D_ | US | — | — | malicious |
1296 | Explorer.EXE | GET | 200 | 217.70.184.50:80 | http://www.balifoodfun.com/ud5f/?op=3noFIlfY57w9VmAlFw7Z5AScJ1/880iDVPqrdJoJinRbodVTEUx4lAYZk5YEB8ciPXyTfA==&EDfLe=ChTpWThHeb7D_ | FR | html | 2.66 Kb | malicious |
1296 | Explorer.EXE | GET | 403 | 185.53.179.172:80 | http://www.paraphras.com/ud5f/?op=GPYY6t7WneNx9qo0qRGO6BxKeZ2Xxe06wEX4D4JiZ8EiFaMYgYCE/Z6x9DTlIhsB7SkV5w==&EDfLe=ChTpWThHeb7D_ | DE | html | 146 b | malicious |
1296 | Explorer.EXE | GET | 301 | 139.162.151.111:80 | http://www.hathor-network.net/ud5f/?op=N47h5gq0HEO4VGTE3Urn1RX+sC4GQJ+jHGA5UfvnI3UtiP0Mf214HE7gTI2Q5K4WMj1nNg==&EDfLe=ChTpWThHeb7D_ | DE | html | 344 b | malicious |
1296 | Explorer.EXE | GET | 302 | 210.188.240.5:80 | http://www.spaceokara.com/ud5f/?op=9CmrMn0GHtTWx3AZipK6yWXZmlYii/OvswjFNfGMD5AzzaTP0I9tRrWPkArZjjlTxJVDsw==&EDfLe=ChTpWThHeb7D_ | JP | html | 230 b | malicious |
1296 | Explorer.EXE | GET | 200 | 23.202.231.167:80 | http://www.ruibaituobj.com/ud5f/?op=8oOvcX3Nl3t3bQWLnZHHRPZAzu4+RuieeOoq8WgyG75v5ok+9/E5HggO9VfxKFeZYDwV2Q==&EDfLe=ChTpWThHeb7D_ | US | html | 378 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1296 | Explorer.EXE | 172.255.36.136:80 | www.tripnii.com | Nobis Technology Group, LLC | US | malicious |
2264 | control.exe | 172.255.36.136:80 | www.tripnii.com | Nobis Technology Group, LLC | US | malicious |
1296 | Explorer.EXE | 217.70.184.50:80 | www.balifoodfun.com | GANDI SAS | FR | malicious |
1296 | Explorer.EXE | 76.164.193.180:80 | www.dadagrin.com | Versaweb, LLC | US | malicious |
1296 | Explorer.EXE | 172.67.177.150:80 | www.madetopraisehim.com | — | US | malicious |
1296 | Explorer.EXE | 66.96.160.152:80 | www.freerenoadvice.com | The Endurance International Group, Inc. | US | malicious |
1296 | Explorer.EXE | 198.54.117.218:80 | www.marmolsystem.com | Namecheap, Inc. | US | malicious |
1296 | Explorer.EXE | 210.188.240.5:80 | www.spaceokara.com | SAKURA Internet Inc. | JP | malicious |
1296 | Explorer.EXE | 23.202.231.167:80 | www.bjyunjian.com | Akamai Technologies, Inc. | US | malicious |
— | — | 139.162.151.111:80 | www.hathor-network.net | Linode, LLC | DE | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.balifoodfun.com |
| malicious |
www.tripnii.com |
| malicious |
dns.msftncsi.com |
| shared |
www.freerenoadvice.com |
| malicious |
www.madetopraisehim.com |
| malicious |
www.marmolsystem.com |
| malicious |
www.dadagrin.com |
| malicious |
www.paraphras.com |
| malicious |
www.spaceokara.com |
| malicious |
www.hathor-network.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1296 | Explorer.EXE | Generic Protocol Command Decode | SURICATA HTTP Unexpected Request body |
1296 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1296 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1296 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1296 | Explorer.EXE | Generic Protocol Command Decode | SURICATA HTTP Unexpected Request body |
1296 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1296 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1296 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1296 | Explorer.EXE | Generic Protocol Command Decode | SURICATA HTTP Unexpected Request body |
1296 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |