File name:

vbc.exe

Full analysis: https://app.any.run/tasks/f31fe8e4-8229-4656-92ff-aacceb59cd01
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: April 05, 2022, 02:57:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
formbook
trojan
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

ACC0FA2FB917D569363074E40BCEC689

SHA1:

2FF041955791387642B93DC15D7F5FFC1EAA6997

SHA256:

F7F012260FD5AEA6DE6701CB5677DD9A900A4E188A1DE3611F47EB2C41BF2FA6

SSDEEP:

6144:HNeZm6OOufOV5qIftjckGf88YqhQPIpG7wcQE/T+5X:HNl6kOVQIB/GXG/Mcc5X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • kwstu.exe (PID: 2064)
      • kwstu.exe (PID: 3356)
    • Drops executable file immediately after starts

      • vbc.exe (PID: 2940)
    • FORMBOOK detected by memory dumps

      • services.exe (PID: 3536)
    • FORMBOOK was detected

      • Explorer.EXE (PID: 1296)
    • Connects to CnC server

      • Explorer.EXE (PID: 1296)
  • SUSPICIOUS

    • Reads the computer name

      • vbc.exe (PID: 2940)
      • kwstu.exe (PID: 3356)
    • Checks supported languages

      • vbc.exe (PID: 2940)
      • kwstu.exe (PID: 2064)
      • kwstu.exe (PID: 3356)
    • Executable content was dropped or overwritten

      • vbc.exe (PID: 2940)
    • Drops a file with a compile date too recent

      • vbc.exe (PID: 2940)
    • Application launched itself

      • kwstu.exe (PID: 2064)
    • Starts CMD.EXE for commands execution

      • services.exe (PID: 3536)
    • Reads Environment values

      • services.exe (PID: 3536)
  • INFO

    • Checks supported languages

      • services.exe (PID: 3536)
      • cmd.exe (PID: 1896)
    • Manual execution by user

      • services.exe (PID: 3536)
    • Reads the computer name

      • services.exe (PID: 3536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(3536) services.exe
C2www.deirdremoncy.com/ud5f/
Decoys and strings (148)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Mail\
\Foxmail
\Storage\
\Accounts\Account.rec0
\Data\AccCfg\Accounts.tdat
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
qy818.store
my-paypal.online
smartlegalandidprotection.com
powellpromo.com
versatilegems.com
engelskapiste.com
thelocksmithexpo.com
aixiaoka.top
induququyui.com
cheyannejewels.com
mfkplatinum.info
albutrusgips.com
delfinyevent.com
mgbuilldingmaterials.com
ozhomefurniture.com
manifiestoccs.com
theblackbarnfields.com
dazzleside.com
kobaygym.com
xn--evdenifikirleri-e6c.com
csliuxue.com
alwayspositivemood.com
bespokeneedlework.com
apfasteners.com
shyridrel.space
thongcongnghetsaigon24h.com
heartwork.ink
dfyh168.com
empregosbr1.online
12pgslot321.online
linkmainsta.com
buyjoellemonet.com
tsdsbjt.com
accom2012.com
miaglam.com
southwesthuntingadventures.com
liquidationone.com
onlineloanforbadcredit.com
lacimaeventos.com
palisadesskipatrol.com
kushrushmia.com
1upgeekmania.com
xn--2e0br59a7ucquav02b.com
keukentafelrestaurant.store
flossent.com
cleaningservicesearchcan.com
clients-panel.club
ameliastore.online
onetone-design.com
unlimitedsea.com
essaysparlor.com
lokisolutions.biz
trendrelation.com
cxhdflfx.online
arloconstruction.net
lostdevice.xyz
healingyourbodynaturally.com
physiocare-ye.com
realhindisexkahani.com
doyleloghomes.info
rugisdh.com
devnetsecops.com
degengains.com
healthcarerevamped.com
f-end
Modules (42)kernel32.dll
advapi32.dll
ws2_32.dll
svchost.exe
msiexec.exe
wuauclt.exe
lsass.exe
wlanext.exe
msg.exe
lsm.exe
dwm.exe
help.exe
chkdsk.exe
cmmon32.exe
nbtstat.exe
spoolsv.exe
rdpclip.exe
control.exe
taskhost.exe
rundll32.exe
systray.exe
audiodg.exe
wininit.exe
services.exe
autochk.exe
autoconv.exe
autofmt.exe
cmstp.exe
colorcpl.exe
cscript.exe
explorer.exe
WWAHost.exe
ipconfig.exe
msdt.exe
mstsc.exe
NAPSTAT.EXE
netsh.exe
NETSTAT.EXE
raserver.exe
wscript.exe
wuapp.exe
cmd.exe
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 23:55:49+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x34f7
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Sep-2021 21:55:49
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 25-Sep-2021 21:55:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006515
0x00006600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.43971
.rdata
0x00008000
0x0000139A
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14577
.data
0x0000A000
0x00020338
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.0137
.ndata
0x0002B000
0x00010000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0003B000
0x00000A50
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.18462

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29934
830
UNKNOWN
English - United States
RT_MANIFEST
103
2.16096
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start vbc.exe kwstu.exe no specs kwstu.exe no specs #FORMBOOK services.exe no specs cmd.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1296C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1896/c del "C:\Users\admin\AppData\Local\Temp\kwstu.exe"C:\Windows\System32\cmd.exeservices.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2064C:\Users\admin\AppData\Local\Temp\kwstu.exe C:\Users\admin\AppData\Local\Temp\frvywyC:\Users\admin\AppData\Local\Temp\kwstu.exevbc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\kwstu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscms.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\user32.dll
2940"C:\Users\admin\AppData\Local\Temp\vbc.exe" C:\Users\admin\AppData\Local\Temp\vbc.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3356C:\Users\admin\AppData\Local\Temp\kwstu.exe C:\Users\admin\AppData\Local\Temp\frvywyC:\Users\admin\AppData\Local\Temp\kwstu.exekwstu.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\kwstu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3536"C:\Windows\System32\services.exe"C:\Windows\System32\services.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Services and Controller app
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\cryptbase.dll
Formbook
(PID) Process(3536) services.exe
C2www.deirdremoncy.com/ud5f/
Decoys and strings (148)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Mail\
\Foxmail
\Storage\
\Accounts\Account.rec0
\Data\AccCfg\Accounts.tdat
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
qy818.store
my-paypal.online
smartlegalandidprotection.com
powellpromo.com
versatilegems.com
engelskapiste.com
thelocksmithexpo.com
aixiaoka.top
induququyui.com
cheyannejewels.com
mfkplatinum.info
albutrusgips.com
delfinyevent.com
mgbuilldingmaterials.com
ozhomefurniture.com
manifiestoccs.com
theblackbarnfields.com
dazzleside.com
kobaygym.com
xn--evdenifikirleri-e6c.com
csliuxue.com
alwayspositivemood.com
bespokeneedlework.com
apfasteners.com
shyridrel.space
thongcongnghetsaigon24h.com
heartwork.ink
dfyh168.com
empregosbr1.online
12pgslot321.online
linkmainsta.com
buyjoellemonet.com
tsdsbjt.com
accom2012.com
miaglam.com
southwesthuntingadventures.com
liquidationone.com
onlineloanforbadcredit.com
lacimaeventos.com
palisadesskipatrol.com
kushrushmia.com
1upgeekmania.com
xn--2e0br59a7ucquav02b.com
keukentafelrestaurant.store
flossent.com
cleaningservicesearchcan.com
clients-panel.club
ameliastore.online
onetone-design.com
unlimitedsea.com
essaysparlor.com
lokisolutions.biz
trendrelation.com
cxhdflfx.online
arloconstruction.net
lostdevice.xyz
healingyourbodynaturally.com
physiocare-ye.com
realhindisexkahani.com
doyleloghomes.info
rugisdh.com
devnetsecops.com
degengains.com
healthcarerevamped.com
f-end
Modules (42)kernel32.dll
advapi32.dll
ws2_32.dll
svchost.exe
msiexec.exe
wuauclt.exe
lsass.exe
wlanext.exe
msg.exe
lsm.exe
dwm.exe
help.exe
chkdsk.exe
cmmon32.exe
nbtstat.exe
spoolsv.exe
rdpclip.exe
control.exe
taskhost.exe
rundll32.exe
systray.exe
audiodg.exe
wininit.exe
services.exe
autochk.exe
autoconv.exe
autofmt.exe
cmstp.exe
colorcpl.exe
cscript.exe
explorer.exe
WWAHost.exe
ipconfig.exe
msdt.exe
mstsc.exe
NAPSTAT.EXE
netsh.exe
NETSTAT.EXE
raserver.exe
wscript.exe
wuapp.exe
cmd.exe
Total events
753
Read events
753
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2940vbc.exeC:\Users\admin\AppData\Local\Temp\mfbulrhxfojhbinary
MD5:
SHA256:
2940vbc.exeC:\Users\admin\AppData\Local\Temp\frvywybinary
MD5:
SHA256:
2940vbc.exeC:\Users\admin\AppData\Local\Temp\kwstu.exeexecutable
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
38
DNS requests
31
Threats
152

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1296
Explorer.EXE
GET
154.208.194.3:80
http://www.essaysparlor.com/ud5f/?uJoPY4AX=EvZosSIubq0jx91B1DuQTFKgcSxBoYO1BAYqpjH1suRxsZNCUNtFH/1nVc+4/1m9DKdKvw==&BZl=7notQhC
US
malicious
1296
Explorer.EXE
GET
156.226.87.169:80
http://www.miaglam.com/ud5f/?uJoPY4AX=Sh/7jjdLkJkw2P9G6NXNiXkWe6qU3BfAt4lTeG45Omo8vd/KszN/e8zNRa5NxNgbe0tlHw==&BZl=7notQhC
ZA
malicious
1296
Explorer.EXE
GET
301
104.21.74.114:80
http://www.buyjoellemonet.com/ud5f/?uJoPY4AX=ZZyG34jkM7WtQBNTq+eJT7o/iXeYI2EhDdbodLCeq3Mvscs3zM2FrC69ObuNCn8Rc4Iz2A==&BZl=7notQhC
US
malicious
1296
Explorer.EXE
GET
301
104.21.42.62:80
http://www.unlimitedsea.com/ud5f/?uJoPY4AX=sREaoEamV+F2ZbgcwnuwyrMyamPzW8j4H+ta4bT5d6ux6rdunnTJiMtpsu7H0MpiKOQsNQ==&VPxd=GfmXFTbpsV
US
malicious
1296
Explorer.EXE
GET
301
72.167.58.161:80
http://www.healingyourbodynaturally.com/ud5f/?uJoPY4AX=L+U39Q4TNBXFTSd84I/UTFwLsHNj024wyISOXuM89WyUM/5eupHSV6dMLeV20/p9R+fqSA==&VPxd=GfmXFTbpsV
US
malicious
1296
Explorer.EXE
GET
301
104.21.74.114:80
http://www.buyjoellemonet.com/ud5f/?uJoPY4AX=ZZyG34jkM7WtQBNTq+eJT7o/iXeYI2EhDdbodLCeq3Mvscs3zM2FrC69ObuNCn8Rc4Iz2A==&BZl=7notQhC
US
malicious
1296
Explorer.EXE
GET
403
34.102.136.180:80
http://www.physiocare-ye.com/ud5f/?uJoPY4AX=yQ2v/wbikxvWpqgfoVshro+r3IM+CS+uKAbgpxi1ZzTfim8SLi+BGzncLfz0pvu2kOKnOg==&BZl=7notQhC
US
html
300 b
whitelisted
1296
Explorer.EXE
GET
302
172.65.232.115:80
http://www.deirdremoncy.com/ud5f/?uJoPY4AX=kctOXJz/8Ze0ND9UPKKpz0V3U8BcUwTuVPP7cKIUHhEXep8z7dMdPoR59L4JSCoBqurVmw==&BZl=7notQhC
US
html
192 b
malicious
1296
Explorer.EXE
GET
403
34.102.136.180:80
http://www.thelocksmithexpo.com/ud5f/?uJoPY4AX=Qh4d7GFdzdMEaWzm+Szhsn1lOXBrQMpjzpwiFLWCmBGtmCzLICNfiwNFN6LPKwsQ5GY15g==&BZl=7notQhC
US
html
300 b
malicious
1296
Explorer.EXE
GET
404
66.29.145.183:80
http://www.rugisdh.com/ud5f/?uJoPY4AX=D7mSXrQKILrY0ly7n1FdHb7AWR16QuaX/4RVrGgKMK8NsVZ0ENHz79v+MyRx2CpWeyBXYg==&BZl=7notQhC
US
html
277 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1296
Explorer.EXE
66.96.161.144:80
www.healthcarerevamped.com
The Endurance International Group, Inc.
US
malicious
34.102.136.180:80
www.physiocare-ye.com
US
whitelisted
1296
Explorer.EXE
154.208.194.3:80
www.essaysparlor.com
MULTACOM CORPORATION
US
malicious
1296
Explorer.EXE
66.29.145.183:80
www.rugisdh.com
Advantagecom Networks, Inc.
US
malicious
1296
Explorer.EXE
34.102.136.180:80
www.physiocare-ye.com
US
whitelisted
1296
Explorer.EXE
172.65.232.115:80
www.deirdremoncy.com
Cloudflare Inc
US
malicious
1296
Explorer.EXE
104.21.74.114:80
www.buyjoellemonet.com
Cloudflare Inc
US
malicious
1296
Explorer.EXE
156.226.87.169:80
www.miaglam.com
MacroLAN
ZA
malicious
1296
Explorer.EXE
2.57.90.16:80
www.1upgeekmania.com
malicious
1296
Explorer.EXE
154.209.252.198:80
www.dfyh168.com
MULTACOM CORPORATION
US
malicious

DNS requests

Domain
IP
Reputation
www.healthcarerevamped.com
  • 66.96.161.144
malicious
www.physiocare-ye.com
  • 34.102.136.180
whitelisted
www.essaysparlor.com
  • 154.208.194.3
malicious
www.rugisdh.com
  • 66.29.145.183
malicious
www.ozhomefurniture.com
unknown
www.deirdremoncy.com
  • 172.65.232.115
malicious
www.thelocksmithexpo.com
  • 34.102.136.180
malicious
www.qy818.store
malicious
www.buyjoellemonet.com
  • 104.21.74.114
  • 172.67.157.239
malicious
www.apfasteners.com
  • 34.102.136.180
whitelisted

Threats

PID
Process
Class
Message
1296
Explorer.EXE
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
1296
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1296
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1296
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1296
Explorer.EXE
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
1296
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1296
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1296
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1296
Explorer.EXE
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
1296
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
No debug info