Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
20-10-2021 22:31
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY.exe
Resource
win7-en-20211014
General
-
Target
INQUIRY.exe
-
Size
644KB
-
MD5
5a707691406a2638523c755b77a9a46b
-
SHA1
3dbdce0b3b04dbe0ec3ee7e89403f000d9536853
-
SHA256
f08ca756c36edc6ed2a59075dd924b66dc07025cd9e5320b93eee0a148a5fba0
-
SHA512
0adf0ff1b336b252ad93128436c41b0933b67baf32f5ebe0a803f33263d80c41095e582bece484ba02e41639fcc2512c074375aa86393373811279a69a904bca
Malware Config
Extracted
formbook
4.1
h0c4
http://www.cursoukulelegospel.com/h0c4/
looknewly.com
icha2016.com
datnenhoalachn.xyz
fark.ltd
zjlj.site
carpinteriacansino.com
atozmp33.com
oficialacesso.com
tuningfrance.com
rmm-mx96r.net
outsidestyleshop.com
eufundas.com
a91furniture.com
sfme.net
englisch.coach
wallacechen.info
nyayeo.com
jintongstore.com
vanwerknaarwerk.info
thekimlab.net
morvirtualassistant.com
ichatbengal.com
doctors-technology.com
mississippisms.com
koopa.codes
sproutheads.com
gardenkitchenspa.com
hoom.life
wiselogistic.com
appadaptor.com
jumtix.xyz
academiavirtualjjb.com
pcmrmf.com
hlsx069.com
sunielkapoor.com
truetaster.com
rylautosales.com
cgmobile.net
www-inloggen-nl.info
businesswebstrategy.net
fetch-a-sg-hair-transplant.fyi
paintingservicespune.com
cakeeyes.net
tandebrokers.com
navigantcapitalpartners.com
hubska.com
foillaws.com
battletraining.com
bitcoin-recovery.com
yourbuildvideos.com
naturalsumaq.com
prasikapsychotherapy.com
jphousecleaningservices.com
fetch-hepatitis-c.zone
easypay-agent.com
ronaldcraig.com
highonloveshop.com
bayharborislandhouse2.com
aventuramaker.com
han-chill.com
wrapmeupbkk.com
videomarketing.tips
ishouldntbthareasonugohard.com
psychotherapie-wermuth.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/268-61-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/268-62-0x000000000041EDB0-mapping.dmp formbook behavioral1/memory/572-70-0x0000000000070000-0x000000000009E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1556 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
INQUIRY.exeINQUIRY.execscript.exedescription pid process target process PID 1764 set thread context of 268 1764 INQUIRY.exe INQUIRY.exe PID 268 set thread context of 1272 268 INQUIRY.exe Explorer.EXE PID 572 set thread context of 1272 572 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
INQUIRY.exeINQUIRY.execscript.exepid process 1764 INQUIRY.exe 268 INQUIRY.exe 268 INQUIRY.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe 572 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
INQUIRY.execscript.exepid process 268 INQUIRY.exe 268 INQUIRY.exe 268 INQUIRY.exe 572 cscript.exe 572 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
INQUIRY.exeINQUIRY.execscript.exedescription pid process Token: SeDebugPrivilege 1764 INQUIRY.exe Token: SeDebugPrivilege 268 INQUIRY.exe Token: SeDebugPrivilege 572 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
INQUIRY.exeExplorer.EXEcscript.exedescription pid process target process PID 1764 wrote to memory of 268 1764 INQUIRY.exe INQUIRY.exe PID 1764 wrote to memory of 268 1764 INQUIRY.exe INQUIRY.exe PID 1764 wrote to memory of 268 1764 INQUIRY.exe INQUIRY.exe PID 1764 wrote to memory of 268 1764 INQUIRY.exe INQUIRY.exe PID 1764 wrote to memory of 268 1764 INQUIRY.exe INQUIRY.exe PID 1764 wrote to memory of 268 1764 INQUIRY.exe INQUIRY.exe PID 1764 wrote to memory of 268 1764 INQUIRY.exe INQUIRY.exe PID 1272 wrote to memory of 572 1272 Explorer.EXE cscript.exe PID 1272 wrote to memory of 572 1272 Explorer.EXE cscript.exe PID 1272 wrote to memory of 572 1272 Explorer.EXE cscript.exe PID 1272 wrote to memory of 572 1272 Explorer.EXE cscript.exe PID 572 wrote to memory of 1556 572 cscript.exe cmd.exe PID 572 wrote to memory of 1556 572 cscript.exe cmd.exe PID 572 wrote to memory of 1556 572 cscript.exe cmd.exe PID 572 wrote to memory of 1556 572 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exeC:\Users\Admin\AppData\Local\Temp\INQUIRY.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:268 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"3⤵
- Deletes itself
PID:1556
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-65-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/268-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/268-64-0x0000000000B90000-0x0000000000E93000-memory.dmpFilesize
3.0MB
-
memory/268-62-0x000000000041EDB0-mapping.dmp
-
memory/268-59-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/268-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/572-69-0x00000000003A0000-0x00000000003C2000-memory.dmpFilesize
136KB
-
memory/572-67-0x0000000000000000-mapping.dmp
-
memory/572-70-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/572-71-0x0000000002000000-0x0000000002303000-memory.dmpFilesize
3.0MB
-
memory/572-72-0x0000000001DD0000-0x0000000001E63000-memory.dmpFilesize
588KB
-
memory/1272-66-0x0000000007290000-0x00000000073F1000-memory.dmpFilesize
1.4MB
-
memory/1272-73-0x0000000007DD0000-0x0000000007F4A000-memory.dmpFilesize
1.5MB
-
memory/1556-68-0x0000000000000000-mapping.dmp
-
memory/1764-57-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1764-58-0x00000000005B0000-0x00000000005DE000-memory.dmpFilesize
184KB
-
memory/1764-56-0x0000000002170000-0x00000000021C1000-memory.dmpFilesize
324KB
-
memory/1764-54-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB