File name:

f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18

Full analysis: https://app.any.run/tasks/21ca23ad-ff80-46c5-a76a-922cfd37a623
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 18:06:09
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
formbook
xloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

FEE446D6526018C56DAD7B2A1D9985D9

SHA1:

72BEF49603C18177836454C60BE5C8EFCDAFA276

SHA256:

F649CB30517D1962E1FCF02CDD1E7CEC98731954B308F3C61BDB8B8530A44F18

SSDEEP:

24576:hF9cmGSFf1RuJCBR0oxI6HLvwDuf7cy3QeAv77atMOjNuUJ899c:39cmGSFf1RuJCBeoxI6HLvwDuf7cy3Qm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK has been detected (YARA)

      • f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe (PID: 6908)

  • SUSPICIOUS

    • Executes application which crashes

      • f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe (PID: 6908)

    • Application launched itself

      • f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe (PID: 3952)

  • INFO

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7020)

    • Checks supported languages

      • f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe (PID: 3952)

    • Reads the machine GUID from the registry

      • f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe (PID: 3952)

    • Reads the computer name

      • f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe (PID: 3952)

    • Checks proxy server information

      • WerFault.exe (PID: 7020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:03 06:50:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 789504
InitializedDataSize: 20480
UninitializedDataSize: -
EntryPoint: 0xc2b7e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.0.0.0
ProductVersionNumber: 8.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Arkanoid
FileDescription: Arkanoid
FileVersion: 8.0.0
InternalName: Terx.exe
LegalCopyright:
OriginalFileName: Terx.exe
ProductVersion: 8.0.0
AssemblyVersion: 8.9.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe no specs #FORMBOOK f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
3952"C:\Users\admin\AppData\Local\Temp\f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe" C:\Users\admin\AppData\Local\Temp\f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe—explorer.exe
User:
admin
Company:
Arkanoid
Integrity Level:
MEDIUM
Description:
Arkanoid
Exit code:
0
Version:
8.0.0
Modules
Images
c:\users\admin\appdata\local\temp\f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6908"C:\Users\admin\AppData\Local\Temp\f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe"C:\Users\admin\AppData\Local\Temp\f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe
f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe
User:
admin
Company:
Arkanoid
Integrity Level:
MEDIUM
Description:
Arkanoid
Exit code:
3221225477
Version:
8.0.0
Modules
Images
c:\users\admin\appdata\local\temp\f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7020C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6908 -s 228C:\Windows\SysWOW64\WerFault.exe
f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 177
Read events
3 177
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_f649cb30517d1962_d0642b459dc78bfc3e7f8186a1167ce6ce29a9_821a2a57_10264770-c8c9-4145-948a-1df5e7171757\Report.wer —
MD5:—
SHA256:—
7020WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
7020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB6F0.tmp.WERInternalMetadata.xmlxml
MD5:74DEC26DDB5E2C3002A31B075F02F37E
SHA256:FB229A7227A7115716F66F1ED5FB040F523594350FCFBFF1A7C1E4CC7802A7FC
7020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB720.tmp.xmlxml
MD5:20AC07753BA8E304498E64DD066B4693
SHA256:2838A7972999F28D220DAB32740AF9EB8AC7AF6FBC5149036C681B8C91E53E7C
7020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB6A1.tmp.dmpbinary
MD5:34A66867EE84278519404A985FBC71D4
SHA256:3F9ECC5C085936A812530D9A064F3E1A78DF7B4BC2380D3DA32B8FEB08490E43
7020WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
7020WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18.exe.6908.dmpbinary
MD5:7968D8EB38C8F7E3324026EF2FDA62AA
SHA256:7239A8CE389FC2648D61592B3E3D26B3B7EF83AF7FFE76EB946414A7A2BB4248
7020WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:CD5FAC0B51AA44D13A171EFD392EFCD0
SHA256:3556BFB7F7BDF6FAA58963BC3280F479CC9DF7F8D884C458A6049332DFDBCD8A
7020WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:214CB65812AFCEC0523F8D75F52A20CF
SHA256:039657AA5DE2B82124DF07F6B49705EDD2FBEE8982DF314697D110586A2A8557
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6072
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6072
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7020
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6156
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7020
WerFault.exe
GET
200
23.48.23.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7096
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7096
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6072
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6072
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 23.48.23.178
  • 23.48.23.177
  • 23.48.23.169
  • 23.48.23.173
  • 23.48.23.168
  • 23.48.23.180
  • 23.48.23.176
  • 23.48.23.174
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.140
  • 40.126.32.136
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
f649cb30517d1962e1fcf02cdd1e7cec98731954b308f3c61bdb8b8530a44f18