Analysis
-
max time kernel
147s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 09:10
Static task
static1
Behavioral task
behavioral1
Sample
inquiry.exe
Resource
win7-20220715-en
General
-
Target
inquiry.exe
-
Size
763KB
-
MD5
b925e8efec4bb9d7aeb0942999de6d93
-
SHA1
f67ee80014f98136c12d2c72f155bd2371b9df84
-
SHA256
b3592dda04b6002e7edf6dc1fd693ce34f0e592e305ed55b226d25a635033c33
-
SHA512
c2bed2d02391da41f9210b51adaf4990e1a60140ad63d2de200ff62ab9dfe376aef89b2a33c1f0d6ee079eca3cb7f051deeed36adafde249987f730abe5989f7
Malware Config
Extracted
formbook
4.1
ja38
check-info-asked.com
d1g1tal-loops.com
jouw-server.online
xn--9l4b93h4ub.com
jju21.com
johndivine.com
boardinghouses.net
evergreeneq.com
lovemya.xyz
szovegmuhely.com
worldwidedatazehn.net
hollandmulchus.com
mhcbrokers.com
brainwellnesssolutions.com
creatioconsultants.com
troyleedesign.store
hayebenefits.com
atom-ontherox.com
pacificoakllc.com
nailonika.online
tixdyweb.com
boostmedia.agency
cutiemind.com
fbcpear.land
nbaonlineus.com
libretypumps.com
americangaslighter.com
blountfirm.online
titansfitnessapparel.net
ofertascapital.com
baikhati777.xyz
yeslom.xyz
classicscase.com
canineconquest.com
nationallrentacar.com
shiyoushuzhi.com
app-youhodler.site
parkwhiteplainss.com
moldshirt.net
roadsideassistanceillinois.info
turkiyedenalmanyayanakliyat.com
kingoflogisticsgh.info
ywwpjqd.com
printthisstudios.com
appackle.com
dharvest24.biz
terrariaserverhosting.com
778189.com
securitycamera-at-2022.life
dx-ss.com
edtechcreativity.com
eleganse-home.online
theknightstemplar.global
abna.international
1ggn.com
abeylele.com
acoinmintexpert.com
prerising.com
dozivljajskigozdpohorje.com
tongkhodentrangtri.com
fromvalleytosummit.com
kasirselasarbrbd.com
englishzones.com
trading-cracks.com
couches-sofas-98268.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1756-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1756-64-0x000000000041F1F0-mapping.dmp formbook behavioral1/memory/1756-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1348-74-0x0000000000130000-0x000000000015F000-memory.dmp formbook behavioral1/memory/1348-78-0x0000000000130000-0x000000000015F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1768 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
inquiry.exeinquiry.exemsiexec.exedescription pid process target process PID 1836 set thread context of 1756 1836 inquiry.exe inquiry.exe PID 1756 set thread context of 1224 1756 inquiry.exe Explorer.EXE PID 1348 set thread context of 1224 1348 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
inquiry.exemsiexec.exepid process 1756 inquiry.exe 1756 inquiry.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
inquiry.exemsiexec.exepid process 1756 inquiry.exe 1756 inquiry.exe 1756 inquiry.exe 1348 msiexec.exe 1348 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
inquiry.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1756 inquiry.exe Token: SeDebugPrivilege 1348 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
inquiry.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1836 wrote to memory of 1756 1836 inquiry.exe inquiry.exe PID 1836 wrote to memory of 1756 1836 inquiry.exe inquiry.exe PID 1836 wrote to memory of 1756 1836 inquiry.exe inquiry.exe PID 1836 wrote to memory of 1756 1836 inquiry.exe inquiry.exe PID 1836 wrote to memory of 1756 1836 inquiry.exe inquiry.exe PID 1836 wrote to memory of 1756 1836 inquiry.exe inquiry.exe PID 1836 wrote to memory of 1756 1836 inquiry.exe inquiry.exe PID 1224 wrote to memory of 1348 1224 Explorer.EXE msiexec.exe PID 1224 wrote to memory of 1348 1224 Explorer.EXE msiexec.exe PID 1224 wrote to memory of 1348 1224 Explorer.EXE msiexec.exe PID 1224 wrote to memory of 1348 1224 Explorer.EXE msiexec.exe PID 1224 wrote to memory of 1348 1224 Explorer.EXE msiexec.exe PID 1224 wrote to memory of 1348 1224 Explorer.EXE msiexec.exe PID 1224 wrote to memory of 1348 1224 Explorer.EXE msiexec.exe PID 1348 wrote to memory of 1768 1348 msiexec.exe cmd.exe PID 1348 wrote to memory of 1768 1348 msiexec.exe cmd.exe PID 1348 wrote to memory of 1768 1348 msiexec.exe cmd.exe PID 1348 wrote to memory of 1768 1348 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inquiry.exe"C:\Users\Admin\AppData\Local\Temp\inquiry.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inquiry.exe"C:\Users\Admin\AppData\Local\Temp\inquiry.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\inquiry.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-69-0x0000000004EB0000-0x0000000004FBD000-memory.dmpFilesize
1.1MB
-
memory/1224-79-0x0000000004FC0000-0x00000000050D2000-memory.dmpFilesize
1.1MB
-
memory/1224-77-0x0000000004FC0000-0x00000000050D2000-memory.dmpFilesize
1.1MB
-
memory/1348-78-0x0000000000130000-0x000000000015F000-memory.dmpFilesize
188KB
-
memory/1348-76-0x0000000001FE0000-0x0000000002074000-memory.dmpFilesize
592KB
-
memory/1348-75-0x0000000002150000-0x0000000002453000-memory.dmpFilesize
3.0MB
-
memory/1348-74-0x0000000000130000-0x000000000015F000-memory.dmpFilesize
188KB
-
memory/1348-70-0x0000000000000000-mapping.dmp
-
memory/1348-73-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/1756-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1756-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1756-67-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1756-68-0x0000000000260000-0x0000000000275000-memory.dmpFilesize
84KB
-
memory/1756-64-0x000000000041F1F0-mapping.dmp
-
memory/1756-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1756-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1768-72-0x0000000000000000-mapping.dmp
-
memory/1836-54-0x0000000000C20000-0x0000000000CE4000-memory.dmpFilesize
784KB
-
memory/1836-59-0x0000000004740000-0x0000000004774000-memory.dmpFilesize
208KB
-
memory/1836-58-0x0000000005260000-0x00000000052CC000-memory.dmpFilesize
432KB
-
memory/1836-57-0x00000000002D0000-0x00000000002DA000-memory.dmpFilesize
40KB
-
memory/1836-56-0x00000000002A0000-0x00000000002B6000-memory.dmpFilesize
88KB
-
memory/1836-55-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB