analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Product_sample.rar

Full analysis: https://app.any.run/tasks/075a1120-b84d-458c-b5fc-198080a431f9
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: June 18, 2019, 22:06:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
formbook
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

B3EF9DBBA0D1763A503E11F495C7EDA1

SHA1:

0947F0F182E74E8B85EC804AA2233E9004DE4FA5

SHA256:

F1D7A267BAF46DE888A1E6A92010578EDA42DED49C2FB07E2309C8616BC00FD0

SSDEEP:

6144:J6aP8WYLB1RfEoNtBRvz9GFgLLPO9S5j2jq2Kxrnl9dZQ2t:JX8WY/RfEyPRvz9GFg3V5qKdtnt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Product_sample.exe (PID: 2980)
      • Product_sample.exe (PID: 1916)
      • hb2t9zcplnzhzl.exe (PID: 3108)
      • hb2t9zcplnzhzl.exe (PID: 2384)
    • FORMBOOK was detected

      • explorer.exe (PID: 2036)
    • Formbook was detected

      • mstsc.exe (PID: 3648)
      • Firefox.exe (PID: 3028)
    • Connects to CnC server

      • explorer.exe (PID: 2036)
    • Changes the autorun value in the registry

      • mstsc.exe (PID: 3648)
    • Actions looks like stealing of personal data

      • mstsc.exe (PID: 3648)
    • Stealing of credential data

      • mstsc.exe (PID: 3648)
  • SUSPICIOUS

    • Application launched itself

      • Product_sample.exe (PID: 2980)
      • hb2t9zcplnzhzl.exe (PID: 2384)
    • Reads Internet Cache Settings

      • explorer.exe (PID: 2036)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3384)
      • explorer.exe (PID: 2036)
      • DllHost.exe (PID: 3344)
    • Creates files in the user directory

      • explorer.exe (PID: 2036)
      • mstsc.exe (PID: 3648)
    • Starts CMD.EXE for commands execution

      • mstsc.exe (PID: 3648)
    • Executed via COM

      • DllHost.exe (PID: 3344)
    • Loads DLL from Mozilla Firefox

      • mstsc.exe (PID: 3648)
    • Creates files in the program directory

      • DllHost.exe (PID: 3344)
  • INFO

    • Manual execution by user

      • mstsc.exe (PID: 3648)
    • Creates files in the user directory

      • Firefox.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 289553
UncompressedSize: 512000
OperatingSystem: Win32
ModifyDate: 2002:04:03 21:36:17
PackingMethod: Normal
ArchivedFileName: Product_sample.exe
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start winrar.exe product_sample.exe no specs product_sample.exe no specs #FORMBOOK mstsc.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs Copy/Move/Rename/Delete/Link Object hb2t9zcplnzhzl.exe no specs hb2t9zcplnzhzl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3384"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Product_sample.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2980"C:\Users\admin\AppData\Local\Temp\Rar$EXa3384.9921\Product_sample.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3384.9921\Product_sample.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.04.0007
1916C:\Users\admin\AppData\Local\Temp\Rar$EXa3384.9921\Product_sample.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3384.9921\Product_sample.exeProduct_sample.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.04.0007
3648"C:\Windows\System32\mstsc.exe"C:\Windows\System32\mstsc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Connection
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3316/c del "C:\Users\admin\AppData\Local\Temp\Rar$EXa3384.9921\Product_sample.exe"C:\Windows\System32\cmd.exemstsc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2036C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3028"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
mstsc.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
65.0.2
3344C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2384"C:\Program Files\J-zyplx\hb2t9zcplnzhzl.exe"C:\Program Files\J-zyplx\hb2t9zcplnzhzl.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.04.0007
3108C:\Program Files\J-zyplx\hb2t9zcplnzhzl.exe"C:\Program Files\J-zyplx\hb2t9zcplnzhzl.exehb2t9zcplnzhzl.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.04.0007
Total events
548
Read events
505
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
73
Text files
1
Unknown types
5

Dropped files

PID
Process
Filename
Type
2036explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:CB1D4CA6DB4A8226BEB9F52EEEA92A8F
SHA256:8B93E2495940A1DAE7D74A45C0AC21B752D0A60B3BC608657E02C5DD1D3AA78B
2036explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Downloads.lnklnk
MD5:A2E4B817C44B8C7CCABC1DE8BB2D7356
SHA256:9C257B05FADB0083525B39770BD7EB205225073DC9DA0EA981B57FAA930B6A4B
2036explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Product_sample.rar.lnklnk
MD5:7BB52662D5CACEC4BF300EF269DC1E2A
SHA256:8892A600C1E5CFF7D03A0FCA3EE6E1CB5645148C076441C943AC53306938C61C
3648mstsc.exeC:\Users\admin\AppData\Roaming\055428TE\055logrc.inibinary
MD5:2855A82ECDD565B4D957EC2EE05AED26
SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939
2036explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:1C4A9E1B00B624BD401BF22C19DCF0AF
SHA256:6AF37C6F786B255048BA9039B940F45EED3B0E17E1999E6D403F33767B1ECA03
3384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3384.9921\Product_sample.exeexecutable
MD5:EC09897A02DA3D15670269BBDD4CF947
SHA256:689747F900480F05C8F0D40028F98E85CFE1FE80CB0A87564AED47B182D40230
2036explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061820190619\index.datdat
MD5:2492496F9FBAAD4C84365D79A470F63D
SHA256:BFC81181E937C8283579C78E2F68EE23AFBE9EBD52AF01A71BB496446469C333
3344DllHost.exeC:\Program Files\J-zyplx\hb2t9zcplnzhzl.exeexecutable
MD5:EC09897A02DA3D15670269BBDD4CF947
SHA256:689747F900480F05C8F0D40028F98E85CFE1FE80CB0A87564AED47B182D40230
2036explorer.exeC:\Users\admin\AppData\Local\Temp\J-zyplx\hb2t9zcplnzhzl.exeexecutable
MD5:EC09897A02DA3D15670269BBDD4CF947
SHA256:689747F900480F05C8F0D40028F98E85CFE1FE80CB0A87564AED47B182D40230
3648mstsc.exeC:\Users\admin\AppData\Roaming\055428TE\055logim.jpegimage
MD5:D9A42ACD8AD060D54DA941C2FE2F24EB
SHA256:DB9C5A3A137C80F365724D888C2F9428A8294E4C84F6F8543944EB5D2252CA79
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
9
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
explorer.exe
GET
147.135.4.31:80
http://www.psychologyreversenow.com/ha/?6lo04BMX=5x5EwvrLPmsHeUBeYEZtXTHbihifM1R15DfEYLzBvxYX4YRyL0a3cjW/W9PgBloTQ3+j7g==&0P=ZlD0DHTPPje
US
malicious
2036
explorer.exe
POST
23.20.239.12:80
http://www.elsendorf.com/ha/
US
shared
2036
explorer.exe
POST
23.20.239.12:80
http://www.elsendorf.com/ha/
US
shared
2036
explorer.exe
GET
302
23.20.239.12:80
http://www.elsendorf.com/ha/?6lo04BMX=Xs+GM5Uprrwok/HJCSWjrHYNi14CD0NsPVnEhMW5tBug75OUxj/olvGTTcDK2abHoOHOFw==&0P=ZlD0DHTPPje&sql=1
US
html
185 b
shared
2036
explorer.exe
POST
160.124.152.98:80
http://www.thenewlypress.com/ha/
ZA
malicious
2036
explorer.exe
POST
23.20.239.12:80
http://www.elsendorf.com/ha/
US
shared
2036
explorer.exe
GET
404
160.124.152.98:80
http://www.thenewlypress.com/ha/?6lo04BMX=Q/BuhMpIvEEb+0rQ0xJBMaA25Q/Wsgl9qDJMOPZJ9+T9cn9wTS1OZ/JVHCLeIhbim+/TQg==&0P=ZlD0DHTPPje&sql=1
ZA
html
221 b
malicious
2036
explorer.exe
POST
160.124.152.98:80
http://www.thenewlypress.com/ha/
ZA
malicious
2036
explorer.exe
POST
160.124.152.98:80
http://www.thenewlypress.com/ha/
ZA
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2036
explorer.exe
160.124.152.98:80
www.thenewlypress.com
ZA
malicious
2036
explorer.exe
147.135.4.31:80
www.psychologyreversenow.com
OVH SAS
US
malicious
2036
explorer.exe
23.20.239.12:80
www.elsendorf.com
Amazon.com, Inc.
US
shared
160.124.152.98:80
www.thenewlypress.com
ZA
malicious

DNS requests

Domain
IP
Reputation
www.psychologyreversenow.com
  • 147.135.4.31
malicious
www.elsendorf.com
  • 23.20.239.12
shared
www.khaiminhland.info
unknown
www.thenewlypress.com
  • 160.124.152.98
malicious
www.ccluav24.com
unknown
www.gandtlottery.com
unknown
www.opti-tech-be.com
unknown

Threats

PID
Process
Class
Message
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
7 ETPRO signatures available at the full report
No debug info