File name:

EFT INV HST-859 BL-07585900[1139360] Copy.exe

Full analysis: https://app.any.run/tasks/be13f017-e475-4772-9fb3-e8d25ea183dd
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: December 18, 2023, 08:56:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
formbook
xloader
stealer
spyware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

F7BF488B2D9B7B098475EF3E91363DA1

SHA1:

7855EE55B77004584DE0CA3AF59462BF5544474B

SHA256:

DCECACB443E9C0B8B94A6ED95253BFBF184488B23A9F28EB2B4A24FF8DE3FFEA

SSDEEP:

24576:LqI1jwYtb6zZetxVGo7j8FSyn7k1gZEmboO+0jjVwmFbwgJdTRchZKt4PSOMzrvG:LqI1jwYtb6zZetxVGo7j8FSyn7k1gZEz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • taskhost.exe (PID: 2780)

    • FORMBOOK has been detected (YARA)

      • colorcpl.exe (PID: 2976)

    • Connects to the CnC server

      • explorer.exe (PID: 2004)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 2004)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • colorcpl.exe (PID: 2976)

    • Executes as Windows Service

      • taskhost.exe (PID: 2780)

  • INFO

    • Reads the computer name

      • EFT INV HST-859 BL-07585900[1139360] Copy.exe (PID: 2668)

    • Checks supported languages

      • EFT INV HST-859 BL-07585900[1139360] Copy.exe (PID: 2668)

    • Reads the machine GUID from the registry

      • EFT INV HST-859 BL-07585900[1139360] Copy.exe (PID: 2668)

    • Manual execution by a user

      • colorcpl.exe (PID: 2976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(2976) colorcpl.exe
C2www.alonacp.com/rhtn/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)ctwlabs.com
zaimjefhi.online
janetsboutiquestore.com
srello.com
dk1380.com
thuphangahhome.com
usahealthcarenetwork.com
ostbet.com
artbacus.com
kuaitaobao.net
aeinnamehranandegi.com
glassesbestselect.com
drain-pipe-cleaning-47086.bond
beyondhorsemanship.com
cottonfuturesbook.com
fairfieldcountyb.com
worldtoronto.com
onairnepal.com
kongmad.com
host-u.com
channelswhatsapp.com
xowlkjc.com
chaoyoukj.com
sparetech.site
dskwazxc.xyz
nextradeya.net
vhow.net
75693.monster
44695384.top
cuma777asli.net
atlasappsys.com
hanhaiguojidasha.net
monthlycarrentaloffers.com
mhyyt.site
leadijer-conntect.top
75jf.lat
webmasteryhub.tech
shriaonetravels.com
zfedu.net
fingcorp.xyz
dannireading.com
pemudatogell16.com
qyyongjun.com
ambitiousoatmeal.com
ronanwright.com
nippon-ltd.com
hollandflooringllc.com
herauraglow.com
w-qgw3.link
ticksport.net
ipsir.net
czechdepanten.pro
bassconstructiontn.com
superviralteam.com
danielsperaw.net
chefclinics.com
dinocox.com
orassist.com
sclerotiniosescle.best
accutranslations.com
distribuidoraagroglobal.com
bossdogs.shop
qyj688038xlaa.top
ambulancessecours27.info
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2066:08:26 05:45:29+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 613786
InitializedDataSize: 1566
UninitializedDataSize: -
EntryPoint: 0x97d94
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Era Engine scripting library.
CompanyName: ESGS Studio
FileDescription: EngineLibrary
FileVersion: 1.0.0.0
InternalName: EngineLibrary.exe
LegalCopyright: Copyright © 2023
LegalTrademarks: -
OriginalFileName: EngineLibrary.exe
ProductName: EngineLibrary
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
269
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start eft inv hst-859 bl-07585900[1139360] copy.exe no specs calc.exe no specs #FORMBOOK colorcpl.exe no specs cmd.exe no specs #FORMBOOK explorer.exe taskhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1672"C:\Windows\SYSWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe—EFT INV HST-859 BL-07585900[1139360] Copy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Calculator
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\calc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2004C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2668"C:\Users\admin\AppData\Local\Temp\EFT INV HST-859 BL-07585900[1139360] Copy.exe" C:\Users\admin\AppData\Local\Temp\EFT INV HST-859 BL-07585900[1139360] Copy.exe—explorer.exe
User:
admin
Company:
ESGS Studio
Integrity Level:
MEDIUM
Description:
EngineLibrary
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\eft inv hst-859 bl-07585900[1139360] copy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
2780"taskhost.exe"C:\Windows\System32\taskhost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2952/c del "C:\Windows\SYSWOW64\calc.exe"C:\Windows\SysWOW64\cmd.exe—colorcpl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2976"C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Color Control Panel
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\colorcpl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Formbook
(PID) Process(2976) colorcpl.exe
C2www.alonacp.com/rhtn/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)ctwlabs.com
zaimjefhi.online
janetsboutiquestore.com
srello.com
dk1380.com
thuphangahhome.com
usahealthcarenetwork.com
ostbet.com
artbacus.com
kuaitaobao.net
aeinnamehranandegi.com
glassesbestselect.com
drain-pipe-cleaning-47086.bond
beyondhorsemanship.com
cottonfuturesbook.com
fairfieldcountyb.com
worldtoronto.com
onairnepal.com
kongmad.com
host-u.com
channelswhatsapp.com
xowlkjc.com
chaoyoukj.com
sparetech.site
dskwazxc.xyz
nextradeya.net
vhow.net
75693.monster
44695384.top
cuma777asli.net
atlasappsys.com
hanhaiguojidasha.net
monthlycarrentaloffers.com
mhyyt.site
leadijer-conntect.top
75jf.lat
webmasteryhub.tech
shriaonetravels.com
zfedu.net
fingcorp.xyz
dannireading.com
pemudatogell16.com
qyyongjun.com
ambitiousoatmeal.com
ronanwright.com
nippon-ltd.com
hollandflooringllc.com
herauraglow.com
w-qgw3.link
ticksport.net
ipsir.net
czechdepanten.pro
bassconstructiontn.com
superviralteam.com
danielsperaw.net
chefclinics.com
dinocox.com
orassist.com
sclerotiniosescle.best
accutranslations.com
distribuidoraagroglobal.com
bossdogs.shop
qyj688038xlaa.top
ambulancessecours27.info
Total events
562
Read events
557
Write events
5
Delete events
0

Modification events

(PID) Process:(2004) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB010000000425B8FBD140304D952DBE1156DB516600000000020000000000106600000001000020000000DB7CFDADD20035B54FE72E91B52C386E688080B10C096541937D15768230E9B4000000000E8000000002000020000000FC5BD8C24841EC802021354E72CCCB98F326B765B114F6B99237B0E53C70855230000000E5259FA42E3216E6ABD96FBA3A6491DBFE5EABB7874FD90C6180CAAA39FCB4DA5097AFD783F475C120AF35A7DAD783F44000000017650D25D4C3008FF427790B98E977F1147A37B555438BA5F03FADACC116CEA191D18AD610A15D4BB60F12EF1F1AF002B029515D03AC7340FF8EFA43530BF5CD
(PID) Process:(2004) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
9
DNS requests
5
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2004
explorer.exe
GET
301
188.114.96.3:80
http://www.alonacp.com/rhtn/?xVMtB8oh=FyuKzUdhNoFqZY+2sDji1rFlUj8nxlDcDsfv4E5frqAbohVavnuwcS2PDGq6MJ581zrD2g==&1bw=L6AdkJ8PtTAtvfC0
unknown
—
—
unknown
2004
explorer.exe
GET
301
172.67.141.121:80
http://www.cuma777asli.net/rhtn/?xVMtB8oh=0H81Qiagrmg2TXIoFxqcTNvigmgxwFY3mBzmOlvwfT6cIQzd+qqWJukdUB4a2DDHaVfktw==&1bw=L6AdkJ8PtTAtvfC0
unknown
—
—
unknown
2004
explorer.exe
GET
404
66.81.203.196:80
http://www.beyondhorsemanship.com/rhtn/?xVMtB8oh=wkbml3tA5cJvQKBFhzVp8MpMGkA1MQhaW5evpwHdJnB7udht6/8uU7sf0rEgx2b5tNKxww==&1bw=L6AdkJ8PtTAtvfC0
unknown
html
169 b
unknown
2004
explorer.exe
GET
403
23.227.38.74:80
http://www.worldtoronto.com/rhtn/?xVMtB8oh=Lk+ek5A2gVfh8QRKHz8OWjVwyWEbPkBMZjLKO4uFqp0npludp6KngtMJpnAdwTVUgP7ZiQ==&1bw=L6AdkJ8PtTAtvfC0
unknown
html
4.41 Kb
unknown
2004
explorer.exe
GET
301
86.105.245.69:80
http://www.ostbet.com/rhtn/?xVMtB8oh=3hrchsHrYXZNe8IYjkHDHeqbZJaIVli+sd+qbWFE5Pym7BYaS3a8bCq9Gv0Jm6RiH20FnQ==&1bw=L6AdkJ8PtTAtvfC0
unknown
html
175 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
352
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2004
explorer.exe
188.114.96.3:80
www.alonacp.com
CLOUDFLARENET
NL
unknown
2004
explorer.exe
66.81.203.196:80
www.beyondhorsemanship.com
—
VG
unknown
2004
explorer.exe
172.67.141.121:80
www.cuma777asli.net
CLOUDFLARENET
US
unknown
2004
explorer.exe
23.227.38.74:80
www.worldtoronto.com
CLOUDFLARENET
CA
unknown
2004
explorer.exe
86.105.245.69:80
www.ostbet.com
Signet B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
www.alonacp.com
  • 188.114.96.3
  • 188.114.97.3
unknown
www.beyondhorsemanship.com
  • 66.81.203.196
unknown
www.cuma777asli.net
  • 172.67.141.121
  • 104.21.9.41
unknown
www.worldtoronto.com
  • 23.227.38.74
unknown
www.ostbet.com
  • 86.105.245.69
unknown

Threats

PID
Process
Class
Message
2004
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
2004
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EFT INV HST-859 BL-07585900[1139360] Copy.exe