File name:

d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe

Full analysis: https://app.any.run/tasks/13636648-8639-4ed4-989c-f108ed0fe9a8
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: May 30, 2024, 17:04:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
formbook
xloader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BA4626698CABAC08FD9D2440F730E80C

SHA1:

577F8E973CB926B58DFFA2EC5A0AE1F9E451F128

SHA256:

D6F3187EA8A4C0CB9E263A665487060B5B14CAF184A5343B2ED928B67D16A264

SSDEEP:

49152:i6WNkebmEFhOHGo4uh68QqyxBXSCXPGms1lw3F0YmKDSd0ujsE58Vq84wE8hnHkT:N4kEm2O0uh68QqoBXSCXPGms1lw3F0Y6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe (PID: 6204)

    • FORMBOOK has been detected (YARA)

      • d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe (PID: 6204)

  • SUSPICIOUS

    • Executes application which crashes

      • d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe (PID: 6204)

  • INFO

    • Reads mouse settings

      • d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe (PID: 6204)

    • Checks proxy server information

      • WerFault.exe (PID: 6344)

    • Checks supported languages

      • d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe (PID: 6204)

    • Reads the software policy settings

      • WerFault.exe (PID: 6344)

    • Create files in a temporary directory

      • d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe (PID: 6204)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(6204) d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe
C2www.sopaindam.com/as02/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)qwin777.com
robinhoods.live
h3jh-dal.pics
braindeadcopywriting.com
kktcbet1000.com
mpo0463.cfd
raboteshoes.com
ab1718.com
lowcrusiers.com
gregcopelandmusic.com
dkfndch.store
firstclassuni.com
00ewu1ub.com
shunweichemical.com
sugarits.com
marqify.com
mistmajik.com
trezip.online
tinytables.xyz
suestergocoaching.com
dominoad.com
specials.website
thatpilatesgirl.com
vrexpressok.com
sdegtho.com
svhomesinspections.com
rumbol88.com
dzplricfpf.com
fastcoolify.com
bloominginwholeness.com
12ser3.com
curtsreno.com
defx.ventures
dev-patel.xyz
ltyidc.com
wheiunudweowuqiwuebfyewui3.com
039c5m2ciwt99.top
pmpm.xyz
akabuka.net
parkerslandscapingllc.com
hamcast.com
jiangcapable.site
sassysensoryclips.com
arsalan.shop
thecryptocaviar.com
ofbsconsulting.com
j8j3e.cfd
cinexgltd.com
justcallnadia.com
qcyiran.com
uniseekglobal.com
milieunightclub.com
sisasimoslot.com
svizzblem.net
20644.asia
shroomberparty.com
contractcrafters.net
selectstylehome.shop
blackhillspr.com
topsolutionquality.online
diywithbje.com
simplywellcoach.com
popothebear.site
entendiendomedicare.com
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:29 23:18:21+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581632
InitializedDataSize: 486912
UninitializedDataSize: -
EntryPoint: 0x2800a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 9.0.4.4
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
FileVersion: 9.0.4.4
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #FORMBOOK d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe svchost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6204"C:\Users\admin\AppData\Local\Temp\d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe" C:\Users\admin\AppData\Local\Temp\d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Version:
9.0.4.4
Modules
Images
c:\users\admin\appdata\local\temp\d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
Formbook
(PID) Process(6204) d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe
C2www.sopaindam.com/as02/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)qwin777.com
robinhoods.live
h3jh-dal.pics
braindeadcopywriting.com
kktcbet1000.com
mpo0463.cfd
raboteshoes.com
ab1718.com
lowcrusiers.com
gregcopelandmusic.com
dkfndch.store
firstclassuni.com
00ewu1ub.com
shunweichemical.com
sugarits.com
marqify.com
mistmajik.com
trezip.online
tinytables.xyz
suestergocoaching.com
dominoad.com
specials.website
thatpilatesgirl.com
vrexpressok.com
sdegtho.com
svhomesinspections.com
rumbol88.com
dzplricfpf.com
fastcoolify.com
bloominginwholeness.com
12ser3.com
curtsreno.com
defx.ventures
dev-patel.xyz
ltyidc.com
wheiunudweowuqiwuebfyewui3.com
039c5m2ciwt99.top
pmpm.xyz
akabuka.net
parkerslandscapingllc.com
hamcast.com
jiangcapable.site
sassysensoryclips.com
arsalan.shop
thecryptocaviar.com
ofbsconsulting.com
j8j3e.cfd
cinexgltd.com
justcallnadia.com
qcyiran.com
uniseekglobal.com
milieunightclub.com
sisasimoslot.com
svizzblem.net
20644.asia
shroomberparty.com
contractcrafters.net
selectstylehome.shop
blackhillspr.com
topsolutionquality.online
diywithbje.com
simplywellcoach.com
popothebear.site
entendiendomedicare.com
6252"C:\Users\admin\AppData\Local\Temp\d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe" C:\Windows\SysWOW64\svchost.exe—d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6344C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6204 -s 752C:\Windows\SysWOW64\WerFault.exe
d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 796
Read events
3 796
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
7
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
6344WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_d6f3187ea8a4c0cb_38173842816d7ee8d9fc596bd67f1a317bb77f36_a7394ff7_1d78a67b-3768-4be0-95b9-f7ec68f3097b\Report.wer —
MD5:—
SHA256:—
6204d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exeC:\Users\admin\AppData\Local\Temp\aut3A56.tmpbinary
MD5:237096186EE1CEF78576A188A1E25231
SHA256:CBFAB2D252D6F4ABBBAEFC69364986DCCC67FE8C631EC4BF287B8BF13225EAF7
6204d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exeC:\Users\admin\AppData\Local\Temp\Coclesbinary
MD5:897B96F0DF37BB3E3B62FBFC1588B5A0
SHA256:A4D1F67F089B472DD304E23D8EDE7228A9CC8F63F9D50A7BD9693F10FAD902CD
6204d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exeC:\Users\admin\AppData\Local\Temp\aut3A86.tmpbinary
MD5:25665F11CEC73A9A4AA177F9FBB21F65
SHA256:E2155E6611D2F239CC6D7185D816CD3CDB78D0D23BCA5165385A75C1F415361D
6344WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER3FC5.tmp.dmpdmp
MD5:A75FCF170031140318CC48319F54264D
SHA256:243AF0D9FC3C0CCB0020F156379817B5A636B7A927858B53431167E749160C24
6204d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exeC:\Users\admin\AppData\Local\Temp\Montevideotext
MD5:77FAF4B786A932875D5900B77056C660
SHA256:7FC505F481957D3A570B502089243546C2A80B02964CD3ED789EAAC6DDFA033A
6344WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER41BA.tmp.WERInternalMetadata.xmlxml
MD5:2E04E369BB9F0417CF0C4B9449B77ED3
SHA256:31BC6839BF3B1F05B2FC59116CF462343E8EF5E5C5797A1CC8E2DA4825234D1C
6344WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:CBA2426F2AAFE31899569ACE05E89796
SHA256:A465FEBE8A024E3CDB548A3731B2EA60C7B2919E941A24B9A42890B2B039B85A
6344WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:92706FC4A03962F6C468B9A5B1B8E5B1
SHA256:A28AFA000B23A948ED166FCA16FB714BC4DF24A7373AE046AA41E5AC8C2C455A
6344WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:23E663AD81C9272BE5114F8C7E4DD1D5
SHA256:E8A891BD9CC0448A7E7A33E03CF14A184069FEE7BF1E2EB853FE06E517562948
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
53
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6344
WerFault.exe
GET
200
23.211.9.92:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6344
WerFault.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5632
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5632
svchost.exe
GET
200
23.211.9.92:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
1752
SIHClient.exe
GET
200
23.211.9.92:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
4392
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6888
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
1752
SIHClient.exe
GET
200
23.211.9.92:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
unknown
5632
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4540
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6344
WerFault.exe
104.208.16.94:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6344
WerFault.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
6344
WerFault.exe
23.211.9.92:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5632
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5632
svchost.exe
23.211.9.92:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 23.211.9.92
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.14
whitelisted
go.microsoft.com
  • 23.43.62.58
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
d6f3187ea8a4c0cb9e263a665487060b5b14caf184a5343b2ed928b67d16a264.exe