File name: | 7vgMI-Rk_geHx0xHeALIbNfZFWiLh5OHCRGQH8d99oQ.bin |
Full analysis: | https://app.any.run/tasks/e3344d20-839a-4679-bac9-c44ac0859036 |
Verdict: | Malicious activity |
Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
Analysis date: | January 18, 2019, 12:40:26 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jan 18 01:21:35 2019, Last Saved Time/Date: Fri Jan 18 01:26:47 2019, Security: 0 |
MD5: | 78616C87C1AE77BED4D5265D9A937B98 |
SHA1: | 6A973607EB3D3CC7EDE0BD2C0C48C238FDF18E50 |
SHA256: | EEF80C23F464FA0787C74C477802C86CD7D915688B8793870911901FC77DF684 |
SSDEEP: | 1536:Fk3hOdsylKlgryzc4bNhZFGzE+cL2knAEsjRUPcspcwucbHcAgcJXcHhcN6kca0D:Fk3hOdsylKlgryzc4bNhZFGzE+cL2kn8 |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
CompObjUserType: | Microsoft Excel 2003 Worksheet |
---|---|
CompObjUserTypeLen: | 31 |
HeadingPairs: |
|
TitleOfParts: | Sheet1 |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
ModifyDate: | 2019:01:18 01:26:47 |
CreateDate: | 2019:01:18 01:21:35 |
Software: | Microsoft Excel |
LastModifiedBy: | - |
Author: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2996 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3972 | C:\Users\admin\AppData\Local\Temp\tempora.com | C:\Users\admin\AppData\Local\Temp\tempora.com | — | EXCEL.EXE |
User: admin Company: Simon Tatham Integrity Level: MEDIUM Description: SSH, Telnet and Rlogin client Exit code: 0 Version: Release 0.70 | ||||
2500 | "C:\Windows\System32\wlanext.exe" | C:\Windows\System32\wlanext.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Wireless LAN 802.11 Extensibility Framework Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2656 | /c del "C:\Users\admin\AppData\Local\Temp\tempora.com" | C:\Windows\System32\cmd.exe | — | wlanext.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
284 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3800 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | wlanext.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 61.0.2 | ||||
3104 | C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} | C:\Windows\system32\DllHost.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1636 | "C:\Program Files\Mhdrl9xmx\regsvcyvvhdblp.exe" | C:\Program Files\Mhdrl9xmx\regsvcyvvhdblp.exe | — | explorer.exe |
User: admin Company: Simon Tatham Integrity Level: MEDIUM Description: SSH, Telnet and Rlogin client Exit code: 0 Version: Release 0.70 | ||||
2412 | "C:\Windows\System32\taskhost.exe" | C:\Windows\System32\taskhost.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2996 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRE812.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2996 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF79A1B283A41A5E77.TMP | — | |
MD5:— | SHA256:— | |||
2996 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF475DA05B0D0C4D21.TMP | — | |
MD5:— | SHA256:— | |||
2996 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@friendpaste[1].txt | text | |
MD5:30EE3FB001A398061514A8E37324ACE9 | SHA256:F3D7E888C8BB1911C73B9CA32B4710492460F12C3C5E853146C4E4F1DAA12746 | |||
2500 | wlanext.exe | C:\Users\admin\AppData\Roaming\219N9U6T\219logrc.ini | binary | |
MD5:2855A82ECDD565B4D957EC2EE05AED26 | SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939 | |||
2996 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\raw[1].txt | text | |
MD5:E8B633B073DDA168DBC267C302D72DE6 | SHA256:82C56A1E6BEAED3D4BC64E202A560E3326519E54E80483517781B108C43042B0 | |||
2996 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\tempora.com | executable | |
MD5:86AEBE0DCA28007BE380AFBC44B3AD86 | SHA256:D801093ED95FE70166C0743720DD58812C057D5086DD04826DD57C0D1BCFA157 | |||
2996 | EXCEL.EXE | C:\Users\admin\Documents\My Data Sources\FOLDER.ICO | image | |
MD5:A6DDCCFDAD18D5CA7AAEB168B6D02253 | SHA256:3114451F95C7FB8D7D884A19C724F6C7FF906B6D9BEC1BF7C6300D2CCA4F43A6 | |||
2996 | EXCEL.EXE | C:\Users\admin\Documents\My Data Sources\+Connect to New Data Source.odc | html | |
MD5:16A8A9A2B0A8B65FAF28E1007DB6733F | SHA256:3A13080059292811E5AC3F9E8B04B2C8EEA95D6A5538116AD751D11C834E6056 | |||
2996 | EXCEL.EXE | C:\Users\admin\Documents\My Data Sources\+NewSQLServerConnection.odc | html | |
MD5:149E8C684B9EA9887DD2E7E596E7187C | SHA256:43B12E68FB3B5BCC4099D796FA670A62B116A894437454A20050661DEF9D8816 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
284 | explorer.exe | POST | — | 104.224.194.71:80 | http://dongtuowuliu.com/results/ | US | — | — | malicious |
284 | explorer.exe | POST | — | 104.224.194.71:80 | http://dongtuowuliu.com/results/ | US | — | — | malicious |
284 | explorer.exe | GET | 404 | 104.224.194.71:80 | http://dongtuowuliu.com/results/?PPx=7Mvu92GYn4tIazjtcfKayTEFRroaK2fU8iZ5/2vm2ExSO7v6alsh9Lmitu79FuMzmWqjNg==&3fs=Jz9L_rT&sql=1 | US | html | 3.56 Kb | malicious |
284 | explorer.exe | POST | — | 104.224.194.71:80 | http://dongtuowuliu.com/results/ | US | — | — | malicious |
284 | explorer.exe | GET | 301 | 216.240.142.110:80 | http://njglzz.com/results/?PPx=8L2vQcrtVFY/QcmEKf92S2XLzICAFQHLgUP8SFiAXSz/GMz/pfv4N7UqO/Kh0sFO9bMxAw==&3fs=Jz9L_rT | US | html | 178 b | malicious |
284 | explorer.exe | GET | 404 | 185.175.208.69:80 | http://svashizlle.com/results/?PPx=6VZYsfE18WLgC5WOYWZI4Sx28VPTt5qeDW90/KxIEykO4UWir6SNykU/u3el9+OkYLp0qQ==&3fs=Jz9L_rT&sql=1 | DE | html | 331 b | malicious |
284 | explorer.exe | POST | 404 | 185.175.208.69:80 | http://svashizlle.com/results/ | DE | html | 277 b | malicious |
284 | explorer.exe | POST | — | 185.175.208.69:80 | http://svashizlle.com/results/ | DE | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
284 | explorer.exe | 104.224.194.71:80 | dongtuowuliu.com | eSited Solutions | US | malicious |
284 | explorer.exe | 216.240.142.110:80 | njglzz.com | MULTACOM CORPORATION | US | malicious |
2996 | EXCEL.EXE | 149.202.176.20:443 | friendpaste.com | OVH SAS | FR | unknown |
284 | explorer.exe | 185.175.208.69:80 | svashizlle.com | Hydra Communications Ltd | DE | malicious |
Domain | IP | Reputation |
---|---|---|
friendpaste.com |
| unknown |
andichain.com |
| unknown |
mkcose.com |
| unknown |
njglzz.com |
| malicious |
dongtuowuliu.com |
| malicious |
pemjoladgroup.com |
| unknown |
surgeonelderlaw.com |
| unknown |
svashizlle.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
284 | explorer.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious HTTP-GET request with body and minimal header |
284 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
284 | explorer.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious HTTP-GET request with body and minimal header |
284 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
284 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
284 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
284 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
284 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
284 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
284 | explorer.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious HTTP-GET request with body and minimal header |