Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 22:31
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY.exe
Resource
win7-en-20211014
General
-
Target
INQUIRY.exe
-
Size
644KB
-
MD5
5a707691406a2638523c755b77a9a46b
-
SHA1
3dbdce0b3b04dbe0ec3ee7e89403f000d9536853
-
SHA256
f08ca756c36edc6ed2a59075dd924b66dc07025cd9e5320b93eee0a148a5fba0
-
SHA512
0adf0ff1b336b252ad93128436c41b0933b67baf32f5ebe0a803f33263d80c41095e582bece484ba02e41639fcc2512c074375aa86393373811279a69a904bca
Malware Config
Extracted
formbook
4.1
h0c4
http://www.cursoukulelegospel.com/h0c4/
looknewly.com
icha2016.com
datnenhoalachn.xyz
fark.ltd
zjlj.site
carpinteriacansino.com
atozmp33.com
oficialacesso.com
tuningfrance.com
rmm-mx96r.net
outsidestyleshop.com
eufundas.com
a91furniture.com
sfme.net
englisch.coach
wallacechen.info
nyayeo.com
jintongstore.com
vanwerknaarwerk.info
thekimlab.net
morvirtualassistant.com
ichatbengal.com
doctors-technology.com
mississippisms.com
koopa.codes
sproutheads.com
gardenkitchenspa.com
hoom.life
wiselogistic.com
appadaptor.com
jumtix.xyz
academiavirtualjjb.com
pcmrmf.com
hlsx069.com
sunielkapoor.com
truetaster.com
rylautosales.com
cgmobile.net
www-inloggen-nl.info
businesswebstrategy.net
fetch-a-sg-hair-transplant.fyi
paintingservicespune.com
cakeeyes.net
tandebrokers.com
navigantcapitalpartners.com
hubska.com
foillaws.com
battletraining.com
bitcoin-recovery.com
yourbuildvideos.com
naturalsumaq.com
prasikapsychotherapy.com
jphousecleaningservices.com
fetch-hepatitis-c.zone
easypay-agent.com
ronaldcraig.com
highonloveshop.com
bayharborislandhouse2.com
aventuramaker.com
han-chill.com
wrapmeupbkk.com
videomarketing.tips
ishouldntbthareasonugohard.com
psychotherapie-wermuth.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4592-120-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4592-121-0x000000000041EDB0-mapping.dmp formbook behavioral2/memory/740-129-0x0000000000800000-0x000000000082E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
INQUIRY.exeINQUIRY.execscript.exedescription pid process target process PID 3592 set thread context of 4592 3592 INQUIRY.exe INQUIRY.exe PID 4592 set thread context of 3040 4592 INQUIRY.exe Explorer.EXE PID 740 set thread context of 3040 740 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
INQUIRY.exeINQUIRY.execscript.exepid process 3592 INQUIRY.exe 3592 INQUIRY.exe 3592 INQUIRY.exe 3592 INQUIRY.exe 3592 INQUIRY.exe 3592 INQUIRY.exe 4592 INQUIRY.exe 4592 INQUIRY.exe 4592 INQUIRY.exe 4592 INQUIRY.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe 740 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
INQUIRY.execscript.exepid process 4592 INQUIRY.exe 4592 INQUIRY.exe 4592 INQUIRY.exe 740 cscript.exe 740 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
INQUIRY.exeINQUIRY.execscript.exedescription pid process Token: SeDebugPrivilege 3592 INQUIRY.exe Token: SeDebugPrivilege 4592 INQUIRY.exe Token: SeDebugPrivilege 740 cscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
INQUIRY.exeExplorer.EXEcscript.exedescription pid process target process PID 3592 wrote to memory of 4608 3592 INQUIRY.exe INQUIRY.exe PID 3592 wrote to memory of 4608 3592 INQUIRY.exe INQUIRY.exe PID 3592 wrote to memory of 4608 3592 INQUIRY.exe INQUIRY.exe PID 3592 wrote to memory of 4592 3592 INQUIRY.exe INQUIRY.exe PID 3592 wrote to memory of 4592 3592 INQUIRY.exe INQUIRY.exe PID 3592 wrote to memory of 4592 3592 INQUIRY.exe INQUIRY.exe PID 3592 wrote to memory of 4592 3592 INQUIRY.exe INQUIRY.exe PID 3592 wrote to memory of 4592 3592 INQUIRY.exe INQUIRY.exe PID 3592 wrote to memory of 4592 3592 INQUIRY.exe INQUIRY.exe PID 3040 wrote to memory of 740 3040 Explorer.EXE cscript.exe PID 3040 wrote to memory of 740 3040 Explorer.EXE cscript.exe PID 3040 wrote to memory of 740 3040 Explorer.EXE cscript.exe PID 740 wrote to memory of 496 740 cscript.exe cmd.exe PID 740 wrote to memory of 496 740 cscript.exe cmd.exe PID 740 wrote to memory of 496 740 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exeC:\Users\Admin\AppData\Local\Temp\INQUIRY.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exeC:\Users\Admin\AppData\Local\Temp\INQUIRY.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/496-127-0x0000000000000000-mapping.dmp
-
memory/740-126-0x0000000000000000-mapping.dmp
-
memory/740-131-0x00000000047C0000-0x0000000004853000-memory.dmpFilesize
588KB
-
memory/740-130-0x0000000004960000-0x0000000004C80000-memory.dmpFilesize
3.1MB
-
memory/740-128-0x0000000000E50000-0x0000000000E77000-memory.dmpFilesize
156KB
-
memory/740-129-0x0000000000800000-0x000000000082E000-memory.dmpFilesize
184KB
-
memory/3040-125-0x0000000005AD0000-0x0000000005C14000-memory.dmpFilesize
1.3MB
-
memory/3040-132-0x0000000005C20000-0x0000000005DB2000-memory.dmpFilesize
1.6MB
-
memory/3592-115-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/3592-119-0x0000000000C40000-0x0000000000C6E000-memory.dmpFilesize
184KB
-
memory/3592-118-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/3592-117-0x0000000004A50000-0x0000000004AA1000-memory.dmpFilesize
324KB
-
memory/4592-123-0x0000000000FB0000-0x00000000012D0000-memory.dmpFilesize
3.1MB
-
memory/4592-124-0x00000000012D0000-0x00000000012E4000-memory.dmpFilesize
80KB
-
memory/4592-121-0x000000000041EDB0-mapping.dmp
-
memory/4592-120-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB