File name:

Request for Quotation All data.exe

Full analysis: https://app.any.run/tasks/006f21cf-a39e-4659-8eaf-174a576072b5
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: December 14, 2023, 09:41:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
formbook
xloader
stealer
spyware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

8238536D80B61DC6CA53C2DBD02CB671

SHA1:

B682299BE4D17EA9E20AD64B2533D7D3C6637101

SHA256:

ADAD245A36FE3960EA429528758080BCEF20F92E84134C7CB66721D8A3D954C0

SSDEEP:

12288:IG3rsqzz0cnKS+2QoAxByu9ODgb0WhM8lU:I5s5KS+2/AxByuwDK0WhMwU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Request for Quotation All data.exe (PID: 2932)

    • FORMBOOK has been detected (YARA)

      • sethc.exe (PID: 1772)

    • Steals credentials

      • sethc.exe (PID: 1772)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Connects to the CnC server

      • explorer.exe (PID: 1944)

    • Actions looks like stealing of personal data

      • sethc.exe (PID: 1772)

  • SUSPICIOUS

    • Application launched itself

      • uvvgm.exe (PID: 1828)

    • Reads the Internet Settings

      • sethc.exe (PID: 1772)

    • Process drops SQLite DLL files

      • sethc.exe (PID: 1772)

  • INFO

    • Create files in a temporary directory

      • Request for Quotation All data.exe (PID: 2932)
      • sethc.exe (PID: 1772)

    • Reads the computer name

      • Request for Quotation All data.exe (PID: 2932)
      • uvvgm.exe (PID: 1828)

    • Checks supported languages

      • Request for Quotation All data.exe (PID: 2932)
      • uvvgm.exe (PID: 1828)
      • uvvgm.exe (PID: 792)

    • Manual execution by a user

      • sethc.exe (PID: 1772)

    • Checks proxy server information

      • sethc.exe (PID: 1772)

    • Creates files or folders in the user directory

      • sethc.exe (PID: 1772)

    • Drops the executable file immediately after the start

      • sethc.exe (PID: 1772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:02 05:20:05+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 120320
UninitializedDataSize: 1024
EntryPoint: 0x30fb
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 22.0.0.1
ProductVersionNumber: 22.0.0.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: definite
FileDescription: wisecrack
FileVersion: 22.0.0.1
ProductVersion: 22.0.0.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start request for quotation all data.exe no specs uvvgm.exe no specs uvvgm.exe no specs #FORMBOOK sethc.exe #FORMBOOK explorer.exe firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—sethc.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
792"C:\Users\admin\AppData\Local\Temp\uvvgm.exe"C:\Users\admin\AppData\Local\Temp\uvvgm.exe—uvvgm.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\uvvgm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1772"C:\Windows\SysWOW64\sethc.exe"C:\Windows\SysWOW64\sethc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessibility shortcut keys
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\sethc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1828"C:\Users\admin\AppData\Local\Temp\uvvgm.exe" C:\Users\admin\AppData\Local\Temp\uvvgm.exe—Request for Quotation All data.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\uvvgm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2932"C:\Users\admin\AppData\Local\Temp\Request for Quotation All data.exe" C:\Users\admin\AppData\Local\Temp\Request for Quotation All data.exe—explorer.exe
User:
admin
Company:
definite
Integrity Level:
MEDIUM
Description:
wisecrack
Exit code:
0
Version:
22.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\request for quotation all data.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 605
Read events
2 583
Write events
22
Delete events
0

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(1944) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1772) sethc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1772) sethc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1772) sethc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1772) sethc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1772) sethc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1772) sethc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1772) sethc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1772) sethc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
2
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1772sethc.exeC:\Users\admin\AppData\Local\Temp\sqlite3.dllexecutable
MD5:7FD80B1CC72DC580C02CA4CFBFB2592D
SHA256:1E6DCCBDF8527ABB53C289DA920463B7895300D0D984CC7E91A3ECDA4E673190
1772sethc.exeC:\Users\admin\AppData\Local\Temp\sqlite3.deftext
MD5:540F7AB54D3B2E6E69222DE98BB6B10E
SHA256:C07C024BF43D8BA619740174D104EACE6C3576CAB357F4A2B0A29B8FD88164DC
1772sethc.exeC:\Users\admin\AppData\Local\Temp\gnz8r8.zipcompressed
MD5:1E73CACCE02AE20026A81F1E56416AA3
SHA256:0DD0DD38CDE5A14E7D6D0830DB62CC7037E521FD042B0B8DA0763128B2C0B3F2
1772sethc.exeC:\Users\admin\AppData\Local\Temp\12-6s1-Hbinary
MD5:CEB39527E05115BBE0227EA14D897374
SHA256:D3406398F5A7D00D94E1F36065ACC5C63DBF27FB4026D75FB09129DDD05C2D20
2932Request for Quotation All data.exeC:\Users\admin\AppData\Local\Temp\uvvgm.exeexecutable
MD5:54F35B2820F58923DA76413A8DBC0620
SHA256:B266A9A34779C6212592DB35E0C2CE64AEB76CAFF8A835037F81A31F97981380
1772sethc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\sqlite-dll-win32-x86-3320000[1].zipcompressed
MD5:1E73CACCE02AE20026A81F1E56416AA3
SHA256:0DD0DD38CDE5A14E7D6D0830DB62CC7037E521FD042B0B8DA0763128B2C0B3F2
2932Request for Quotation All data.exeC:\Users\admin\AppData\Local\Temp\hztjbbvjswg.tvibinary
MD5:D9D3F08A265A659D778358B3191CD1DA
SHA256:93493C9252A07C8CEFEF4FE92F87AFB3D3614CAA18EB08A355BBEAAB2AFA429F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
21
DNS requests
5
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
explorer.exe
GET
200
50.2.203.186:80
http://www.giftjubilee.com/nqpg/?XibEcp8r=W1XSVzV8o/BLiTli4UR5oD5+Zs4qWrSusZQI5u/VECm0tGOy5+WXARY2WYOv9LbBRGnSyUgVymjQVCXGUp+1d828PXUkln14qWp2E6Y=&4gT=yvrm16OH
unknown
html
504 b
unknown
1772
sethc.exe
GET
200
45.33.6.223:80
http://www.sqlite.org/2020/sqlite-dll-win32-x86-3320000.zip
unknown
compressed
486 Kb
unknown
1944
explorer.exe
POST
405
91.195.240.123:80
http://www.ladyboyfaceswap.com/nqpg/
unknown
html
556 b
unknown
1944
explorer.exe
POST
405
91.195.240.123:80
http://www.ladyboyfaceswap.com/nqpg/
unknown
html
556 b
unknown
1944
explorer.exe
POST
405
91.195.240.123:80
http://www.ladyboyfaceswap.com/nqpg/
unknown
html
556 b
unknown
1944
explorer.exe
POST
301
91.203.110.247:80
http://www.wildenmann.shop/nqpg/
unknown
html
707 b
unknown
1944
explorer.exe
POST
405
91.195.240.123:80
http://www.ladyboyfaceswap.com/nqpg/
unknown
html
556 b
unknown
1944
explorer.exe
GET
301
91.203.110.247:80
http://www.wildenmann.shop/nqpg/?XibEcp8r=1KpslnQ4QbNZTsU0ONsS0oGQ82It204Ck+LIR0yunC2Z1oDtXxaLcx1ax9YBySJc2OTajH5Yq0WniUy/eF2QHp54UIx0NJfjBqKnKvU=&4gT=yvrm16OH
unknown
html
707 b
unknown
1944
explorer.exe
POST
301
91.203.110.247:80
http://www.wildenmann.shop/nqpg/
unknown
html
707 b
unknown
1944
explorer.exe
POST
301
91.203.110.247:80
http://www.wildenmann.shop/nqpg/
unknown
html
707 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1944
explorer.exe
50.2.203.186:80
www.giftjubilee.com
AS62904
DE
unknown
1772
sethc.exe
45.33.6.223:80
www.sqlite.org
Linode, LLC
US
unknown
1944
explorer.exe
91.195.240.123:80
www.ladyboyfaceswap.com
SEDO GmbH
DE
unknown
1944
explorer.exe
91.203.110.247:80
www.wildenmann.shop
dogado GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
www.giftjubilee.com
  • 50.2.203.186
unknown
www.sqlite.org
  • 45.33.6.223
whitelisted
www.ladyboyfaceswap.com
  • 91.195.240.123
unknown
www.wildenmann.shop
  • 91.203.110.247
unknown
www.thetruthauthor.com
  • —
unknown

Threats

PID
Process
Class
Message
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
15 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Request for Quotation All data.exe