File name:

PO_08048XT.exe

Full analysis: https://app.any.run/tasks/cfd3cf6a-6cba-4807-8c11-9c180c733f19
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: December 04, 2023, 14:13:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
formbook
xloader
stealer
spyware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

934B70128EE9526A227F0E3A4DEB7C31

SHA1:

D3D62350C6D5A15B2308F799C1FC29B830E96340

SHA256:

E7AAEC4E757952B19A3629E6B25FF54F5B2ECB55E0CD4898F2BA8C66CB859FCA

SSDEEP:

24576:p0SaJqUCMY/Wd6p/nuCarH0FvIDZDcIkSHIliiH9ZljHmEl8M:p0SaJqUCMY/i6p/nuCarUFvIDZDcIkSG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials

      • msfeedssync.exe (PID: 3028)

    • FORMBOOK has been detected (YARA)

      • msfeedssync.exe (PID: 3028)

    • Connects to the CnC server

      • explorer.exe (PID: 1944)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Actions looks like stealing of personal data

      • msfeedssync.exe (PID: 3028)

  • SUSPICIOUS

    • Application launched itself

      • PO_08048XT.exe (PID: 796)

    • Reads the Internet Settings

      • msfeedssync.exe (PID: 3028)

    • Process drops SQLite DLL files

      • msfeedssync.exe (PID: 3028)

  • INFO

    • Manual execution by a user

      • msfeedssync.exe (PID: 3028)

    • Reads the computer name

      • PO_08048XT.exe (PID: 796)

    • Checks supported languages

      • PO_08048XT.exe (PID: 796)
      • PO_08048XT.exe (PID: 2708)

    • Reads the machine GUID from the registry

      • PO_08048XT.exe (PID: 796)

    • Creates files or folders in the user directory

      • msfeedssync.exe (PID: 3028)

    • Create files in a temporary directory

      • msfeedssync.exe (PID: 3028)

    • Checks proxy server information

      • msfeedssync.exe (PID: 3028)

    • Drops the executable file immediately after the start

      • msfeedssync.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2079:06:02 17:09:13+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 720384
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xb1cca
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Accessibility Shortcut
FileVersion: 1.0.0.0
InternalName: cQvAhHlPc.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: cQvAhHlPc.exe
ProductName: Accessibility Shortcut
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start po_08048xt.exe no specs po_08048xt.exe no specs po_08048xt.exe no specs #FORMBOOK msfeedssync.exe #FORMBOOK explorer.exe firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
796"C:\Users\admin\AppData\Local\Temp\PO_08048XT.exe" C:\Users\admin\AppData\Local\Temp\PO_08048XT.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessibility Shortcut
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\po_08048xt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
1612"C:\Users\admin\AppData\Local\Temp\PO_08048XT.exe"C:\Users\admin\AppData\Local\Temp\PO_08048XT.exe—PO_08048XT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessibility Shortcut
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\po_08048xt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2688"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—msfeedssync.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2708"C:\Users\admin\AppData\Local\Temp\PO_08048XT.exe"C:\Users\admin\AppData\Local\Temp\PO_08048XT.exe—PO_08048XT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessibility Shortcut
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\po_08048xt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
3028"C:\Windows\SysWOW64\msfeedssync.exe"C:\Windows\SysWOW64\msfeedssync.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Feeds Synchronization
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\syswow64\msfeedssync.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 215
Read events
2 193
Write events
22
Delete events
0

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(1944) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3028) msfeedssync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3028) msfeedssync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3028) msfeedssync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3028) msfeedssync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3028) msfeedssync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3028) msfeedssync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3028) msfeedssync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3028) msfeedssync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3028msfeedssync.exeC:\Users\admin\AppData\Local\Temp\sqlite3.dllexecutable
MD5:7FD80B1CC72DC580C02CA4CFBFB2592D
SHA256:1E6DCCBDF8527ABB53C289DA920463B7895300D0D984CC7E91A3ECDA4E673190
3028msfeedssync.exeC:\Users\admin\AppData\Local\Temp\sqlite3.deftext
MD5:540F7AB54D3B2E6E69222DE98BB6B10E
SHA256:C07C024BF43D8BA619740174D104EACE6C3576CAB357F4A2B0A29B8FD88164DC
3028msfeedssync.exeC:\Users\admin\AppData\Local\Temp\wlv0idu0.zipcompressed
MD5:1E73CACCE02AE20026A81F1E56416AA3
SHA256:0DD0DD38CDE5A14E7D6D0830DB62CC7037E521FD042B0B8DA0763128B2C0B3F2
3028msfeedssync.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\sqlite-dll-win32-x86-3320000[1].zipcompressed
MD5:1E73CACCE02AE20026A81F1E56416AA3
SHA256:0DD0DD38CDE5A14E7D6D0830DB62CC7037E521FD042B0B8DA0763128B2C0B3F2
3028msfeedssync.exeC:\Users\admin\AppData\Local\Temp\n7w56I4Nbinary
MD5:CEB39527E05115BBE0227EA14D897374
SHA256:D3406398F5A7D00D94E1F36065ACC5C63DBF27FB4026D75FB09129DDD05C2D20
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
23
DNS requests
5
Threats
24

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
explorer.exe
GET
404
217.76.128.47:80
http://www.patrics.online/oefh/?efAb=Fw0QqXPNGo+AFv+K/pUosTG/d36G6djcyS80jPYj14Fl+tBA5dfW/Gzxu7kQMM97morSWktiOalE11yrAiW4d6qsKxxQ7frMKSzjyh4=&NAqb=XSkboal0y
unknown
html
7.67 Kb
unknown
3028
msfeedssync.exe
GET
200
45.33.6.223:80
http://www.sqlite.org/2020/sqlite-dll-win32-x86-3320000.zip
unknown
compressed
486 Kb
unknown
1944
explorer.exe
POST
404
217.76.128.47:80
http://www.patrics.online/oefh/
unknown
html
7.67 Kb
unknown
1944
explorer.exe
POST
302
185.83.214.222:80
http://www.razz.store/oefh/
unknown
—
—
unknown
1944
explorer.exe
POST
302
185.83.214.222:80
http://www.razz.store/oefh/
unknown
—
—
unknown
1944
explorer.exe
POST
302
185.83.214.222:80
http://www.razz.store/oefh/
unknown
—
—
unknown
1944
explorer.exe
GET
302
185.83.214.222:80
http://www.razz.store/oefh/?efAb=SShbXeoCE2bGpigAgQAlKH7r+oDwmUhNJG2Y5goO6YxGu8YNj61XMmNt/snnUM+FT5k5Pq0YOhyO2SF/WyHSrmCBqgZbt5ZccSRGaJw=&NAqb=XSkboal0y
unknown
—
—
unknown
1944
explorer.exe
POST
302
185.83.214.222:80
http://www.razz.store/oefh/
unknown
—
—
unknown
1944
explorer.exe
POST
302
185.83.214.222:80
http://www.razz.store/oefh/
unknown
—
—
unknown
1944
explorer.exe
POST
302
185.83.214.222:80
http://www.razz.store/oefh/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1944
explorer.exe
217.76.128.47:80
www.patrics.online
IONOS SE
ES
unknown
3028
msfeedssync.exe
45.33.6.223:80
www.sqlite.org
Linode, LLC
US
unknown
1944
explorer.exe
185.83.214.222:80
www.razz.store
K4X OU
NO
unknown
1944
explorer.exe
195.24.68.20:80
www.slovena.org
Jsc ru-center
RU
unknown
1944
explorer.exe
91.195.240.19:80
www.yahyag.com
SEDO GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
www.patrics.online
  • 217.76.128.47
unknown
www.sqlite.org
  • 45.33.6.223
whitelisted
www.razz.store
  • 185.83.214.222
unknown
www.slovena.org
  • 195.24.68.20
unknown
www.yahyag.com
  • 91.195.240.19
unknown

Threats

PID
Process
Class
Message
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1944
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
18 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PO_08048XT.exe