Edit tour

Windows Analysis Report
0XLuA614VK.exe

Overview

General Information

Sample name:	0XLuA614VK.exe renamed because original name is a hash value
Original sample name:	4399aa607bbc0faabced85f15b59b4d01a50d79da07f8d6bc825e358ad417e52.exe
Analysis ID:	1504851
MD5:	562cb5dcba0e691bf01ab2c020c0837e
SHA1:	3ca5eb915edcce7da20a7b6046055cb11333647e
SHA256:	4399aa607bbc0faabced85f15b59b4d01a50d79da07f8d6bc825e358ad417e52
Tags:	exe
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

0XLuA614VK.exe (PID: 2956 cmdline: "C:\Users\user\Desktop\0XLuA614VK.exe" MD5: 562CB5DCBA0E691BF01AB2C020C0837E)

svchost.exe (PID: 6400 cmdline: "C:\Users\user\Desktop\0XLuA614VK.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

sXmdPDASzrmzi.exe (PID: 2672 cmdline: "C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

msiexec.exe (PID: 5304 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

firefox.exe (PID: 2300 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x86b44:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x700e3:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e755:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17cf4:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ac20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x141bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e0d3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17672:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ac20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x141bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ac20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x141bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ac20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x141bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x86b44:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x700e3:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2d2d3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16872:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e0d3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17672:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\0XLuA614VK.exe", CommandLine: "C:\Users\user\Desktop\0XLuA614VK.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\0XLuA614VK.exe", ParentImage: C:\Users\user\Desktop\0XLuA614VK.exe, ParentProcessId: 2956, ParentProcessName: 0XLuA614VK.exe, ProcessCommandLine: "C:\Users\user\Desktop\0XLuA614VK.exe", ProcessId: 6400, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\0XLuA614VK.exe", CommandLine: "C:\Users\user\Desktop\0XLuA614VK.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\0XLuA614VK.exe", ParentImage: C:\Users\user\Desktop\0XLuA614VK.exe, ParentProcessId: 2956, ParentProcessName: 0XLuA614VK.exe, ProcessCommandLine: "C:\Users\user\Desktop\0XLuA614VK.exe", ProcessId: 6400, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T14:24:29.528469+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	49711	199.59.243.226	80	TCP
2024-09-05T14:24:53.108803+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57195	72.52.178.23	80	TCP
2024-09-05T14:25:14.634365+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57199	15.197.240.20	80	TCP
2024-09-05T14:25:36.174460+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57203	199.59.243.226	80	TCP
2024-09-05T14:25:58.268529+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57207	162.0.213.94	80	TCP
2024-09-05T14:26:12.167470+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57211	13.248.151.237	80	TCP
2024-09-05T14:26:25.546426+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57215	34.149.87.45	80	TCP
2024-09-05T14:26:38.962807+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57219	91.203.110.247	80	TCP
2024-09-05T14:26:52.280815+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57223	34.149.87.45	80	TCP
2024-09-05T14:27:05.588486+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57227	72.52.178.23	80	TCP
2024-09-05T14:27:19.681884+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57231	199.59.243.226	80	TCP
2024-09-05T14:27:41.175589+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57235	199.59.243.226	80	TCP
2024-09-05T14:27:49.709341+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57236	199.59.243.226	80	TCP
2024-09-05T14:28:02.888098+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	57240	72.52.178.23	80	TCP

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T14:24:29.528469+0200	2855465	1	A Network Trojan was detected	192.168.2.5	49711	199.59.243.226	80	TCP
2024-09-05T14:24:53.108803+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57195	72.52.178.23	80	TCP
2024-09-05T14:25:14.634365+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57199	15.197.240.20	80	TCP
2024-09-05T14:25:36.174460+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57203	199.59.243.226	80	TCP
2024-09-05T14:25:58.268529+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57207	162.0.213.94	80	TCP
2024-09-05T14:26:12.167470+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57211	13.248.151.237	80	TCP
2024-09-05T14:26:25.546426+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57215	34.149.87.45	80	TCP
2024-09-05T14:26:38.962807+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57219	91.203.110.247	80	TCP
2024-09-05T14:26:52.280815+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57223	34.149.87.45	80	TCP
2024-09-05T14:27:05.588486+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57227	72.52.178.23	80	TCP
2024-09-05T14:27:19.681884+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57231	199.59.243.226	80	TCP
2024-09-05T14:27:41.175589+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57235	199.59.243.226	80	TCP
2024-09-05T14:27:49.709341+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57236	199.59.243.226	80	TCP
2024-09-05T14:28:02.888098+0200	2855465	1	A Network Trojan was detected	192.168.2.5	57240	72.52.178.23	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T14:24:45.410661+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57192	72.52.178.23	80	TCP
2024-09-05T14:24:47.999882+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57193	72.52.178.23	80	TCP
2024-09-05T14:24:50.562697+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57194	72.52.178.23	80	TCP
2024-09-05T14:25:06.999734+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57196	15.197.240.20	80	TCP
2024-09-05T14:25:09.543696+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57197	15.197.240.20	80	TCP
2024-09-05T14:25:12.097318+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57198	15.197.240.20	80	TCP
2024-09-05T14:25:28.483319+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57200	199.59.243.226	80	TCP
2024-09-05T14:25:31.040913+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57201	199.59.243.226	80	TCP
2024-09-05T14:25:33.548178+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57202	199.59.243.226	80	TCP
2024-09-05T14:25:50.658954+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57204	162.0.213.94	80	TCP
2024-09-05T14:25:53.204047+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57205	162.0.213.94	80	TCP
2024-09-05T14:25:55.738624+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57206	162.0.213.94	80	TCP
2024-09-05T14:26:04.426223+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57208	13.248.151.237	80	TCP
2024-09-05T14:26:06.979323+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57209	13.248.151.237	80	TCP
2024-09-05T14:26:09.504074+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57210	13.248.151.237	80	TCP
2024-09-05T14:26:17.952179+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57212	34.149.87.45	80	TCP
2024-09-05T14:26:20.494766+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57213	34.149.87.45	80	TCP
2024-09-05T14:26:23.015896+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57214	34.149.87.45	80	TCP
2024-09-05T14:26:31.226240+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57216	91.203.110.247	80	TCP
2024-09-05T14:26:33.887796+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57217	91.203.110.247	80	TCP
2024-09-05T14:26:36.447900+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57218	91.203.110.247	80	TCP
2024-09-05T14:26:44.499385+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57220	34.149.87.45	80	TCP
2024-09-05T14:26:47.030980+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57221	34.149.87.45	80	TCP
2024-09-05T14:26:49.688095+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57222	34.149.87.45	80	TCP
2024-09-05T14:26:57.961604+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57224	72.52.178.23	80	TCP
2024-09-05T14:27:00.476532+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57225	72.52.178.23	80	TCP
2024-09-05T14:27:03.017249+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57226	72.52.178.23	80	TCP
2024-09-05T14:27:11.584928+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57228	199.59.243.226	80	TCP
2024-09-05T14:27:14.189519+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57229	199.59.243.226	80	TCP
2024-09-05T14:27:17.145172+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57230	199.59.243.226	80	TCP
2024-09-05T14:27:33.552885+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57232	199.59.243.226	80	TCP
2024-09-05T14:27:36.110585+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57233	199.59.243.226	80	TCP
2024-09-05T14:27:38.652932+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57234	199.59.243.226	80	TCP
2024-09-05T14:27:55.252464+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57237	72.52.178.23	80	TCP
2024-09-05T14:27:57.753496+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57238	72.52.178.23	80	TCP
2024-09-05T14:28:00.299708+0200	2855464	1	A Network Trojan was detected	192.168.2.5	57239	72.52.178.23	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T14:25:12.097318+0200	2856318	1	A Network Trojan was detected	192.168.2.5	57198	15.197.240.20	80	TCP

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
0XLuA614VK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0XLuA614VK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Windows Analysis Report
0XLuA614VK.exe