Analysis
- max time kernel
126s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:44
General
- Target Inquiry.exe.exe
- Size 395KB
- Sample201109-vcphv53p9n
- SHA256 df2bbdd833be8896f46c8660acfc9da2711f2a75d8338240b781fc6ee3964f9e
Score
10/10
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.joomlas123.com/4vx/
Decoy
-
kontinuer.com
-
outofthebluelove.com
-
docentrood.com
-
emowm.com
-
jsa862.net
-
kshoworld.com
-
kumsalkorel.com
-
adrigh.info
-
goldentrianglerv.com
-
youkuy.com
-
lindaclijsters.com
-
audreyfarley.com
-
alasitter.com
-
uscar-boerse.com
-
successwithfletch.com
-
474opebet.com
-
xjlfb.com
-
doingworkabroad.com
-
0pe864.com
-
ittestperfumeok.live
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\Inquiry.exe.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry.exe.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry.exe.exe"{path}"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Inquiry.exe.exe"{path}"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Inquiry.exe.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2736-0-0x0000000000400000-0x000000000042D000-memory.dmp