Windows Analysis Report
#U00d6DEME FORMU.exe

Overview

General Information

Sample Name: #U00d6DEME FORMU.exe
Analysis ID: 635282
MD5: 0204546cc8568a60d97947c5fd6ccd49
SHA1: ff7c492dd728279cd763af6fa525606431fc8db0
SHA256: eddc1ee1fafda4fe7cf6d114276c992806f33d7527d346464bad7033875fbd66
Tags: exeFormbookgeoTUR
Infos:

Detection

FormBook
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
C2 URLs / IPs found in malware configuration
Creates a DirectInput object (often for capturing keystrokes)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Drops PE files
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.liuchenggang.com/b0y1/"], "decoy": ["newindexpress.com", "tg5szfdz.xyz", "aims1881.com", "bonaegroup.com", "be99caboi8.xyz", "weddingcentrepieces.com", "acigdmodel.com", "ketotax.info", "learnedware.com", "learning-rich-work.store", "multipreset.store", "flyttfirmaorebro.com", "58bilisim.xyz", "joseketofitdiet.site", "duomeishop.com", "programacaozerobarriga.site", "gygezau517.xyz", "awesometutorials.xyz", "hwvzfn3t.xyz", "nycexoticbullies.com", "smallbizmaker.com", "isarfeuer.com", "wacker-silicones.com", "tongtoto.com", "xofitessentials.com", "begep.space", "paperbackbookbox.com", "ihhsiljc.beauty", "jankarbaniye.com", "boli-12.xyz", "gridwriter.com", "377manhua.com", "willywaw98cop.com", "acumelet.com", "theupgradeexperiencemedia.com", "pimientamultimedia.com", "phoenixgold.xyz", "plunderdseign.com", "erdberrehausgsd.net", "aboutsprouts.com", "castle-clash.com", "nwcabin.com", "kurtizanki-spb.com", "yqphx.xyz", "casinowithout.com", "jctcopera.com", "antalyaluxuryvilla.xyz", "sagedidthis.com", "144z.xyz", "iska4peps.life", "rightthewrong.biz", "zib0bsivacf8.xyz", "beijingzhongruanchuangheng.site", "jylfxx.net", "newsletterexperience.com", "rnrprowash.com", "bylunakdy.com", "upasev.online", "businessreputationmanager.com", "kidsacooking.com", "brangusprimebeef.com", "nickhaven.com", "o1apopdpzhah.xyz", "negociodigital.store"]}
Multi AV Scanner detection for submitted file
Source: #U00d6DEME FORMU.exe Virustotal: Detection: 52% Perma Link
Source: #U00d6DEME FORMU.exe ReversingLabs: Detection: 36%
Yara detected FormBook
Source: Yara match File source: 1.2.erltu.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.erltu.exe.b40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.liuchenggang.com/b0y1/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Virustotal: Detection: 47% Perma Link
Source: C:\Users\user\AppData\Local\Temp\erltu.exe ReversingLabs: Detection: 43%
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.erltu.exe.b40000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Uses 32bit PE files
Source: #U00d6DEME FORMU.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: C:\ffsoc\ohboce\qvij\0902cf37fdf1425d9289d1e37d1cf733\cdrrer\lqscatwa\Release\lqscatwa.pdb source: #U00d6DEME FORMU.exe, 00000000.00000002.314547108.00000000026B3000.00000004.00000800.00020000.00000000.sdmp, #U00d6DEME FORMU.exe, 00000000.00000002.314271950.000000000040B000.00000004.00000001.01000000.00000003.sdmp, erltu.exe, 00000001.00000000.276075436.000000000102B000.00000002.00000001.01000000.00000004.sdmp, erltu.exe, 00000001.00000002.280816354.000000000102B000.00000002.00000001.01000000.00000004.sdmp, erltu.exe, 00000002.00000002.542844457.000000000102B000.00000002.00000001.01000000.00000004.sdmp, erltu.exe.0.dr, nsz96AE.tmp.0.dr
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00405426 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405426
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00405D9C SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405D9C
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_004026A1 FindFirstFileA, 0_2_004026A1

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.liuchenggang.com/b0y1/
Creates a DirectInput object (often for capturing keystrokes)
Source: #U00d6DEME FORMU.exe, 00000000.00000002.314392216.00000000006BA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00404FDD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404FDD

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.erltu.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.erltu.exe.b40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.erltu.exe.b40000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.erltu.exe.b40000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.erltu.exe.b40000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.erltu.exe.b40000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: #U00d6DEME FORMU.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 1.2.erltu.exe.b40000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.erltu.exe.b40000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.erltu.exe.b40000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.erltu.exe.b40000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_004032FA EntryPoint,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004032FA
Detected potential crypto function
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_004047EE 0_2_004047EE
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00406083 0_2_00406083
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_0102496E 1_2_0102496E
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_0102959D 1_2_0102959D
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_01026880 1_2_01026880
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_010285D1 1_2_010285D1
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_010138EE 1_2_010138EE
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_01026DF2 1_2_01026DF2
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_01026880 1_2_01026880
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_01026880 1_2_01026880
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_01027364 1_2_01027364
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_0102496E 1_2_0102496E
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_010167AE 1_2_010167AE
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_007F0A2C 1_2_007F0A2C
Source: #U00d6DEME FORMU.exe Virustotal: Detection: 52%
Source: #U00d6DEME FORMU.exe ReversingLabs: Detection: 36%
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe File read: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Jump to behavior
Source: #U00d6DEME FORMU.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\#U00d6DEME FORMU.exe "C:\Users\user\Desktop\#U00d6DEME FORMU.exe"
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Process created: C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\fvcshciph
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Process created: C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\fvcshciph
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Process created: C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\fvcshciph Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Process created: C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\fvcshciph Jump to behavior
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe File created: C:\Users\user\AppData\Local\Temp\nsz96AD.tmp Jump to behavior
Source: classification engine Classification label: mal96.troj.evad.winEXE@5/4@0/0
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00402078 CoCreateInstance,MultiByteToWideChar, 0_2_00402078
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00404333 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_00404333
Source: Binary string: C:\ffsoc\ohboce\qvij\0902cf37fdf1425d9289d1e37d1cf733\cdrrer\lqscatwa\Release\lqscatwa.pdb source: #U00d6DEME FORMU.exe, 00000000.00000002.314547108.00000000026B3000.00000004.00000800.00020000.00000000.sdmp, #U00d6DEME FORMU.exe, 00000000.00000002.314271950.000000000040B000.00000004.00000001.01000000.00000003.sdmp, erltu.exe, 00000001.00000000.276075436.000000000102B000.00000002.00000001.01000000.00000004.sdmp, erltu.exe, 00000001.00000002.280816354.000000000102B000.00000002.00000001.01000000.00000004.sdmp, erltu.exe, 00000002.00000002.542844457.000000000102B000.00000002.00000001.01000000.00000004.sdmp, erltu.exe.0.dr, nsz96AE.tmp.0.dr
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_0101F035 push ecx; ret 1_2_0101F048
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00405DDA GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405DDA
Drops PE files
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe File created: C:\Users\user\AppData\Local\Temp\erltu.exe Jump to dropped file
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00405426 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405426
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00405D9C SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405D9C
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_004026A1 FindFirstFileA, 0_2_004026A1
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\erltu.exe API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_0102457B IsDebuggerPresent, 1_2_0102457B
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_007F061D mov eax, dword ptr fs:[00000030h] 1_2_007F061D
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_007F06F7 mov eax, dword ptr fs:[00000030h] 1_2_007F06F7
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_007F0772 mov eax, dword ptr fs:[00000030h] 1_2_007F0772
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_007F0736 mov eax, dword ptr fs:[00000030h] 1_2_007F0736
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_007F03F8 mov eax, dword ptr fs:[00000030h] 1_2_007F03F8
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_01024395 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 1_2_01024395
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\#U00d6DEME FORMU.exe Code function: 0_2_00405DDA GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405DDA
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_0102538A GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError, 1_2_0102538A
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_010214BB SetUnhandledExceptionFilter, 1_2_010214BB
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_010214EC SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_010214EC
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Process created: C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\erltu.exe C:\Users\user\AppData\Local\Temp\fvcshciph Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_0101FE73 cpuid 1_2_0101FE73
Source: C:\Users\user\AppData\Local\Temp\erltu.exe Code function: 1_2_01020FE8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 1_2_01020FE8

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.erltu.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.erltu.exe.b40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.erltu.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.erltu.exe.b40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.280690320.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 635282 Sample: #U00d6DEME FORMU.exe Startdate: 27/05/2022 Architecture: WINDOWS Score: 96 17 Found malware configuration 2->17 19 Malicious sample detected (through community Yara rule) 2->19 21 Antivirus detection for URL or domain 2->21 23 3 other signatures 2->23 7 #U00d6DEME FORMU.exe 19 2->7         started        process3 file4 15 C:\Users\user\AppData\Local\Temp\erltu.exe, PE32 7->15 dropped 10 erltu.exe 7->10         started        process5 signatures6 25 Multi AV Scanner detection for dropped file 10->25 27 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 10->27 13 erltu.exe 10->13         started        process7
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.liuchenggang.com/b0y1/ true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 low