Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 13:56
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe
Resource
win7-en-20211014
General
-
Target
INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe
-
Size
460KB
-
MD5
4bc84a1a436c849698fd54c0f921c2a1
-
SHA1
c7c7cb7b33da65ffc53ff9351b56802cb1561560
-
SHA256
25e5055023abbb8c18992618b6f04c94b8b13ff8bd33d4a4f8462d92902461bf
-
SHA512
c86ec6b9fef554818af6aacdc7df24bb7ad1813390f6e708c7b9cd385a274286419c3f738d55ef411a1be82cbf462e483525ef20e27a4b6b24ceb4fc99001f19
Malware Config
Extracted
formbook
4.1
cnp0
http://www.ccnsv.net/cnp0/
jiarenyuanhunlian.com
xquizitelashesnwaxx.com
rentinerie.com
herbalpedia-id.com
openseagames.com
re-swap.com
william-cook.com
segensv.com
versebay.com
brendanlairdsound.com
bypestor.com
hospitaldelpc.net
wwwroadrunnerfinancial.com
waterhammerstudios.com
hustleandbank.photography
secure01bchslogin.com
rarepeperanking.com
greatland.company
happybirthdayjewel.com
raheok.store
citrusarrow.coffee
midwest-oktoberfest.com
dpcuow.com
creativeartsfilmacademy.biz
sse-audio.com
offertasuperfibra.com
gizpsikolojikdanisma.com
7aomoquzb9.com
filthycarproductions.online
fuquba.com
lovinzion.com
istanbulmadencilik.com
treasuretroveofrecipes.com
exploitporbrl.xyz
seneorreward.com
sx-mz.com
mylcsservices.digital
paidimage.xyz
tayyqc.com
congoqueen.com
cerrajerovalls.online
iwasehokenservice.net
chuahoinach.net
savouri.online
brandonjanisieski.com
seo-clicks7.com
aplusvibe.com
incotporate.com
webdyx.com
pit.land
sdnfmrmi.com
skinbluecap.com
maestractiva.com
tianshunhong.com
maddenconstance.com
wonderkdesign.com
keycuracao.com
lebzcl.com
toriyabeblog.com
clicksfrog.com
the22yards.club
peakprocesssolutions.com
sustainabilityreview.com
onceuponawreathde.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-64-0x000000000041F0D0-mapping.dmp formbook behavioral1/memory/1908-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1872-72-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1988 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exeINQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exechkdsk.exedescription pid process target process PID 1764 set thread context of 1908 1764 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe PID 1908 set thread context of 1264 1908 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe Explorer.EXE PID 1872 set thread context of 1264 1872 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exechkdsk.exepid process 1908 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe 1908 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe 1872 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exechkdsk.exepid process 1908 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe 1908 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe 1908 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe 1872 chkdsk.exe 1872 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1908 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe Token: SeDebugPrivilege 1872 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1764 wrote to memory of 1908 1764 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe PID 1764 wrote to memory of 1908 1764 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe PID 1764 wrote to memory of 1908 1764 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe PID 1764 wrote to memory of 1908 1764 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe PID 1764 wrote to memory of 1908 1764 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe PID 1764 wrote to memory of 1908 1764 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe PID 1764 wrote to memory of 1908 1764 INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe PID 1264 wrote to memory of 1872 1264 Explorer.EXE chkdsk.exe PID 1264 wrote to memory of 1872 1264 Explorer.EXE chkdsk.exe PID 1264 wrote to memory of 1872 1264 Explorer.EXE chkdsk.exe PID 1264 wrote to memory of 1872 1264 Explorer.EXE chkdsk.exe PID 1872 wrote to memory of 1988 1872 chkdsk.exe cmd.exe PID 1872 wrote to memory of 1988 1872 chkdsk.exe cmd.exe PID 1872 wrote to memory of 1988 1872 chkdsk.exe cmd.exe PID 1872 wrote to memory of 1988 1872 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INQUIRY DOCUMENTS & DATA COMPANY INFORMATION.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1264-68-0x0000000003B20000-0x0000000003C05000-memory.dmpFilesize
916KB
-
memory/1264-75-0x0000000006BD0000-0x0000000006CF5000-memory.dmpFilesize
1.1MB
-
memory/1764-57-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/1764-58-0x0000000000370000-0x0000000000377000-memory.dmpFilesize
28KB
-
memory/1764-59-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/1764-60-0x0000000000C50000-0x0000000000CA0000-memory.dmpFilesize
320KB
-
memory/1764-55-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/1872-69-0x0000000000000000-mapping.dmp
-
memory/1872-71-0x0000000000150000-0x0000000000157000-memory.dmpFilesize
28KB
-
memory/1872-72-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1872-73-0x0000000001FD0000-0x00000000022D3000-memory.dmpFilesize
3.0MB
-
memory/1872-74-0x0000000001E40000-0x0000000001ED3000-memory.dmpFilesize
588KB
-
memory/1908-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1908-66-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/1908-67-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/1908-64-0x000000000041F0D0-mapping.dmp
-
memory/1908-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1908-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1988-70-0x0000000000000000-mapping.dmp