File name:

SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349

Full analysis: https://app.any.run/tasks/c9bb3b74-1cae-4a1b-acbf-a8b357cf9b36
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: September 11, 2024, 17:31:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
formbook
xloader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

5B1984F2410016C4586CF31F4A5BBE7C

SHA1:

4D95A806D41EEB0906B325B2088935AA5F01115B

SHA256:

F4BD1F9DEC0127BE05780B194DBA31EDA1A4882EC5DF8E46C93AA6B58A5F337E

SSDEEP:

24576:Ur3Y75ByulaEgT/QCt8/9EIvnwbew2nCK/VKbtBLzJyXoBNa5qrxdM/yUSOC1S:Ur3i5ByulaEgT/QCi/9EIvnwbew2nCKF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK has been detected (YARA)

      • SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe (PID: 5072)

  • SUSPICIOUS

    • Application launched itself

      • SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe (PID: 5344)

    • Executes application which crashes

      • SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe (PID: 5072)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe (PID: 5344)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe (PID: 5344)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6160)

    • Reads the computer name

      • SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe (PID: 5344)

    • Reads the software policy settings

      • WerFault.exe (PID: 6160)

    • Checks proxy server information

      • WerFault.exe (PID: 6160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:09:11 15:02:33+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 797696
InitializedDataSize: 6656
UninitializedDataSize: -
EntryPoint: 0xc4b3a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.2.0.0
ProductVersionNumber: 3.2.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: KastleSoft
FileDescription: Parcheesi
FileVersion: 3.2.0.0
InternalName: fiKb.exe
LegalCopyright: KastleSoft © 2014
LegalTrademarks: -
OriginalFileName: fiKb.exe
ProductName: Parcheesi
ProductVersion: 3.2.0.0
AssemblyVersion: 3.1.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.trojanloader.msil.davinci.heur.19397.9349.exe no specs securiteinfo.com.trojanloader.msil.davinci.heur.19397.9349.exe no specs securiteinfo.com.trojanloader.msil.davinci.heur.19397.9349.exe no specs #FORMBOOK securiteinfo.com.trojanloader.msil.davinci.heur.19397.9349.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
3660"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe—SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe
User:
admin
Company:
KastleSoft
Integrity Level:
MEDIUM
Description:
Parcheesi
Exit code:
4294967295
Version:
3.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.trojanloader.msil.davinci.heur.19397.9349.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5072"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe
SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe
User:
admin
Company:
KastleSoft
Integrity Level:
MEDIUM
Description:
Parcheesi
Exit code:
3221225477
Version:
3.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.trojanloader.msil.davinci.heur.19397.9349.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5344"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe—explorer.exe
User:
admin
Company:
KastleSoft
Integrity Level:
MEDIUM
Description:
Parcheesi
Exit code:
0
Version:
3.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.trojanloader.msil.davinci.heur.19397.9349.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6160C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5072 -s 228C:\Windows\SysWOW64\WerFault.exe
SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6996"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe—SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe
User:
admin
Company:
KastleSoft
Integrity Level:
MEDIUM
Description:
Parcheesi
Exit code:
4294967295
Version:
3.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.trojanloader.msil.davinci.heur.19397.9349.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
3 160
Read events
3 160
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6160WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SecuriteInfo.com_54544544fd6462641b9bcb04eb6e3386663ca1f_6d243c0e_22365659-03fe-492c-b4c8-2e50e2d775f7\Report.wer —
MD5:—
SHA256:—
6160WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WEREE8.tmp.dmpbinary
MD5:34CE56F6E07BF0EA947A2DDC7513385B
SHA256:D189B531E02C2BEB6088CC26DB22F5B5FC18DBAE83FD7672638145D7D9476FB1
6160WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:FB64A9EBEDF48D3895381D5B7D80743D
SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42
6160WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:1B7FD5177461034E4086724C5845E927
SHA256:065AF18C229898A1C2A8D989911ADCD9B1E2AB14B1953EBF8EAF34AE37EA1627
6160WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349.exe.5072.dmpdmp
MD5:BE3B90078A54E5B6870D294724F558C6
SHA256:8759C1BECF9144B5715C9A6DCA267E814AA36D0E7D7F0A6A09DE5BC2947E97A5
6160WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF17.tmp.WERInternalMetadata.xmlxml
MD5:1D82F5E354575F0B917BDB7BD19EE62B
SHA256:85CD93E7AB7EBF0E8E7BA1D6A1209760F07A7F9EC1DA72269E98344EA73F8FB9
6160WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:7B0957FE675B615F6D7A99264731BF11
SHA256:A7F0936FACDCB027A5CC528371BD36C43258608EDE794326A56CB6FBEA8E92E4
6160WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF47.tmp.xmlxml
MD5:0981ED1D85D6C7764B3845A4B255D639
SHA256:CE7A43B62F1D8C601A2CA12781131AAD3A7F5F94073E06123299822B65D81C5F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
32
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7072
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6160
WerFault.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6908
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1964
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1964
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7072
svchost.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6908
svchost.exe
40.126.29.15:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6908
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
7072
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1964
SIHClient.exe
40.68.123.157:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 23.218.209.163
  • 88.221.169.152
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.29.15
  • 40.126.29.10
  • 20.190.157.11
  • 40.126.29.5
  • 40.126.29.6
  • 40.126.29.9
  • 40.126.29.7
  • 40.126.29.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.21
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.19397.9349