top title background image
flash

u8QPnVhq0N.exe

Status: finished
Submission Time: 2023-03-20 17:46:23 +01:00
Malicious
Trojan
Spyware
Evader
FormBook

Comments

Tags

  • 32
  • exe
  • Formbook
  • trojan

Details

  • Analysis ID:
    830804
  • API (Web) ID:
    1197903
  • Original Filename:
    7de990046a20e6666627273589b014a5.exe
  • Analysis Started:
    2023-03-20 17:49:26 +01:00
  • Analysis Finished:
    2023-03-20 18:02:48 +01:00
  • MD5:
    7de990046a20e6666627273589b014a5
  • SHA1:
    55ebccd35c2329c5816cd0240b0919651ac58321
  • SHA256:
    ebce15ad53b98d7aba7f7544ee947e88f58d696e22ca4bc5d15b2ded37b577ac
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 33/68
malicious
Score: 18/39
malicious

IPs

IP Country Detection
85.187.128.34
United States
91.195.240.94
Germany
78.141.192.145
France
Click to see the 7 hidden entries
161.97.163.8
United States
81.17.29.149
Switzerland
192.185.17.12
United States
94.176.104.86
Romania
213.145.228.111
Austria
72.14.185.43
United States
199.192.30.147
United States

Domains

Name IP Detection
www.bitservicesltd.com
161.97.163.8
www.younrock.com
81.17.29.149
www.energyservicestation.com
213.145.228.111
Click to see the 12 hidden entries
www.thewildphotographer.co.uk
72.14.185.43
www.shapshit.xyz
199.192.30.147
www.222ambking.org
91.195.240.94
thedivinerudraksha.com
85.187.128.34
un-object.com
192.185.17.12
white-hat.uk
94.176.104.86
gritslab.com
78.141.192.145
www.un-object.com
0.0.0.0
www.white-hat.uk
0.0.0.0
www.gritslab.com
0.0.0.0
www.thedivinerudraksha.com
0.0.0.0
www.fclaimrewardccpointq.shop
0.0.0.0

URLs

Name Detection
http://www.energyservicestation.com/u2kb/?X51Qjm=IK59b/MdFRha+CUVMWpzDpHQ2riuD6F66TLC1fPPNwLnZq29gpb12AWvlZbo17UEh0sBgFvevrMQsuZfYKuAI0Y2tVIkdALeFw==&w6DN_=E0EQSM0RCb349p
http://www.thewildphotographer.co.uk/u2kb/
http://www.bitservicesltd.com/u2kb/?X51Qjm=rr+sOBvEXsBdGevUkZEAvniGWrNxzC1YNHmXivr92FQhRIIYsedRhL+YGaN2VCieGtjtLTUTzUqxDX3Wf7WovfMRM9ceCuTm3Q==&w6DN_=E0EQSM0RCb349p
Click to see the 76 hidden entries
http://www.shapshit.xyz/u2kb/
http://www.bitservicesltd.com/u2kb/
http://www.shapshit.xyz/u2kb/?X51Qjm=Yd5Rzn4EVOpL1Cl/e5Amzdaa+E7UlYBpl8BtE0ZhlgLGbR5cH1Fns9iDSFPM0EqDoX1il4mP+EMsdt2zebBg7FEeCQ3NU/ifUg==&w6DN_=E0EQSM0RCb349p
http://www.white-hat.uk/u2kb/?X51Qjm=PXfMycAZpTAipct8YsIgv6PR3Y11yPgF2k7967nf/qU1A0mUqq9Jy2mfr4kURdfD0IyZUuXLnrTzZCke5/3g9z1JjJjKyNNZNw==&w6DN_=E0EQSM0RCb349p
http://www.un-object.com/u2kb/
http://www.gritslab.com/u2kb/?X51Qjm=ydCzFiH7iMWnz6xHMre3IWaEcfnK5+fYQUsmgPEoYCSsyD6HgT3yZXCBsea1O+OKnOGwPNRrrKn2ANadQmZuoq3zmdf3x1nRXg==&w6DN_=E0EQSM0RCb349p
http://www.energyservicestation.com/u2kb/
http://www.222ambking.org/u2kb/?X51Qjm=IEUpLmGg2fqLmrhwDd0CH8vm0i8ubOQDFcodV2ACJcW4bHSQscR3aN4MRDv2q1O0g2vnwuasF99orDvyVUehJPYRcFQEZ60O6g==&w6DN_=E0EQSM0RCb349p
http://white-hat.uk/u2kb/?X51Qjm=PXfMycAZpTAipct8YsIgv6PR3Y11yPgF2k7967nf/qU1A0mUqq9Jy2mfr4kURdfD0Iy
http://www.222ambking.org/u2kb/
http://www.younrock.com/u2kb/?X51Qjm=05tPwqSdqXO2xf32BHQi8E1nUfoFa2c80hhB3sQ3FFDNPs5AZDU6EjUymll22Wm6Scj5xbzg3GdXyuHgSKqxyFLAdmHecJKz/g==&w6DN_=E0EQSM0RCb349p
http://www.gritslab.com/u2kb/
http://www.younrock.com/u2kb/?X51Qjm=05tPwqSdqXO2xf32BHQi8E1nUfoFa2c80hhB3sQ3FFDNPs5AZDU6EjUymll22Wm
http://www.thedivinerudraksha.com/u2kb/?X51Qjm=im5SXjRwbJIZeY2yeMVWNNnKg99Etck2UhYi2fNZ2Kf/X7lq2SPR1Q6pROq8Gck3yLtOH/fXnE++yuD9U7pvtIMkBqNJDo2oag==&w6DN_=E0EQSM0RCb349p
http://www.younrock.com/u2kb/
http://www.thedivinerudraksha.com/u2kb/
http://www.bitservicesltd.com/u2kb/www.bitservicesltd.com
http://www.thedivinerudraksha.com/u2kb/www.thedivinerudraksha.com
http://nsis.sf.net/NSIS_ErrorError
http://www.un-object.com/u2kb/www.un-object.com
https://www.sedo.com/services/parking.php3
http://www.avisrezervee.com/u2kb/
http://www.mygloballojistik.online/u2kb/www.mygloballojistik.online
http://www.fclaimrewardccpointq.shop
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
https://alldomains.hosting/
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
https://ac.ecosia.org/autocomplete?q=
https://search.yahoo.com?fr=crmas_sfp
http://www.ecomofietsen.com/u2kb/
https://alldomains.hosting/hosting-webhosting.html
http://www.germanreps.com/u2kb/www.germanreps.com
http://www.germanreps.com/u2kb/
http://www.employerseervices.com
http://www.younrock.com/u2kb/www.younrock.com
http://www.222ambking.org
http://www.shapshit.xyz/u2kb/www.shapshit.xyz
http://thedivinerudraksha.com/u2kb/?X51Qjm=im5SXjRwbJIZeY2yeMVWNNnKg99Etck2UhYi2fNZ2Kf/X7lq2SPR1Q6pR
http://www.ecomofietsen.com/u2kb/www.ecomofietsen.com
http://www.un-object.com
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
https://duckduckgo.com/chrome_newtab
http://www.mygloballojistik.online
http://www.employerseervices.com/u2kb/www.employerseervices.com
http://www.white-hat.uk
http://www.energyservicestation.com/u2kb/www.energyservicestation.com
http://www.white-hat.uk/u2kb/www.white-hat.uk
http://www.thedivinerudraksha.com
http://www.ecomofietsen.com
http://www.germanreps.com
http://www.shapshit.xyz
http://www.dzyngiri.com
http://www.thewildphotographer.co.uk/u2kb/www.thewildphotographer.co.uk
https://search.yahoo.com?fr=crmas_sfpf
http://img.sedoparking.com
https://www.name.com/domain/renew/222ambking.org?utm_source=Sedo_parked_page&utm_medium=button&utm_c
http://www.gritslab.com/u2kb/www.gritslab.com
https://duckduckgo.com/ac/?q=
http://www.avisrezervee.com/u2kb/www.avisrezervee.com
http://www.thewildphotographer.co.uk
http://www.younrock.com
http://www.employerseervices.com/u2kb/
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
http://www.energyservicestation.com
http://www.autoitscript.com/autoit3/J
http://www.fclaimrewardccpointq.shop/u2kb/
http://www.222ambking.org/u2kb/www.222ambking.org
http://www.fclaimrewardccpointq.shop/u2kb/www.fclaimrewardccpointq.shop
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
http://www.gritslab.com
https://alldomains.hosting/domain-registrieren.html
http://www.white-hat.uk/u2kb/
http://justinmezzell.com
http://www.bitservicesltd.com
http://www.avisrezervee.com
http://www.mygloballojistik.online/u2kb/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\mcwfy.exe
PE32 executable (console) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\HI4NJ046K
SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
#
C:\Users\user\AppData\Local\Temp\nsl6A3E.tmp
data
#
Click to see the 2 hidden entries
C:\Users\user\AppData\Local\Temp\ortnkgsjk.g
data
#
C:\Users\user\AppData\Local\Temp\ytljtt.f
data
#