Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 09:10
Static task
static1
Behavioral task
behavioral1
Sample
inquiry.exe
Resource
win7-20220715-en
General
-
Target
inquiry.exe
-
Size
763KB
-
MD5
b925e8efec4bb9d7aeb0942999de6d93
-
SHA1
f67ee80014f98136c12d2c72f155bd2371b9df84
-
SHA256
b3592dda04b6002e7edf6dc1fd693ce34f0e592e305ed55b226d25a635033c33
-
SHA512
c2bed2d02391da41f9210b51adaf4990e1a60140ad63d2de200ff62ab9dfe376aef89b2a33c1f0d6ee079eca3cb7f051deeed36adafde249987f730abe5989f7
Malware Config
Extracted
formbook
4.1
ja38
check-info-asked.com
d1g1tal-loops.com
jouw-server.online
xn--9l4b93h4ub.com
jju21.com
johndivine.com
boardinghouses.net
evergreeneq.com
lovemya.xyz
szovegmuhely.com
worldwidedatazehn.net
hollandmulchus.com
mhcbrokers.com
brainwellnesssolutions.com
creatioconsultants.com
troyleedesign.store
hayebenefits.com
atom-ontherox.com
pacificoakllc.com
nailonika.online
tixdyweb.com
boostmedia.agency
cutiemind.com
fbcpear.land
nbaonlineus.com
libretypumps.com
americangaslighter.com
blountfirm.online
titansfitnessapparel.net
ofertascapital.com
baikhati777.xyz
yeslom.xyz
classicscase.com
canineconquest.com
nationallrentacar.com
shiyoushuzhi.com
app-youhodler.site
parkwhiteplainss.com
moldshirt.net
roadsideassistanceillinois.info
turkiyedenalmanyayanakliyat.com
kingoflogisticsgh.info
ywwpjqd.com
printthisstudios.com
appackle.com
dharvest24.biz
terrariaserverhosting.com
778189.com
securitycamera-at-2022.life
dx-ss.com
edtechcreativity.com
eleganse-home.online
theknightstemplar.global
abna.international
1ggn.com
abeylele.com
acoinmintexpert.com
prerising.com
dozivljajskigozdpohorje.com
tongkhodentrangtri.com
fromvalleytosummit.com
kasirselasarbrbd.com
englishzones.com
trading-cracks.com
couches-sofas-98268.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4368-136-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4368-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4680-144-0x00000000010B0000-0x00000000010DF000-memory.dmp formbook behavioral2/memory/4680-149-0x00000000010B0000-0x00000000010DF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
inquiry.exeinquiry.exeraserver.exedescription pid process target process PID 1012 set thread context of 4368 1012 inquiry.exe inquiry.exe PID 4368 set thread context of 2196 4368 inquiry.exe Explorer.EXE PID 4680 set thread context of 2196 4680 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
inquiry.exeraserver.exepid process 4368 inquiry.exe 4368 inquiry.exe 4368 inquiry.exe 4368 inquiry.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe 4680 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2196 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
inquiry.exeraserver.exepid process 4368 inquiry.exe 4368 inquiry.exe 4368 inquiry.exe 4680 raserver.exe 4680 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
inquiry.exeraserver.exedescription pid process Token: SeDebugPrivilege 4368 inquiry.exe Token: SeDebugPrivilege 4680 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
inquiry.exeExplorer.EXEraserver.exedescription pid process target process PID 1012 wrote to memory of 4368 1012 inquiry.exe inquiry.exe PID 1012 wrote to memory of 4368 1012 inquiry.exe inquiry.exe PID 1012 wrote to memory of 4368 1012 inquiry.exe inquiry.exe PID 1012 wrote to memory of 4368 1012 inquiry.exe inquiry.exe PID 1012 wrote to memory of 4368 1012 inquiry.exe inquiry.exe PID 1012 wrote to memory of 4368 1012 inquiry.exe inquiry.exe PID 2196 wrote to memory of 4680 2196 Explorer.EXE raserver.exe PID 2196 wrote to memory of 4680 2196 Explorer.EXE raserver.exe PID 2196 wrote to memory of 4680 2196 Explorer.EXE raserver.exe PID 4680 wrote to memory of 4924 4680 raserver.exe cmd.exe PID 4680 wrote to memory of 4924 4680 raserver.exe cmd.exe PID 4680 wrote to memory of 4924 4680 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inquiry.exe"C:\Users\Admin\AppData\Local\Temp\inquiry.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inquiry.exe"C:\Users\Admin\AppData\Local\Temp\inquiry.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\inquiry.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1012-131-0x0000000005640000-0x0000000005BE4000-memory.dmpFilesize
5.6MB
-
memory/1012-132-0x0000000005140000-0x00000000051D2000-memory.dmpFilesize
584KB
-
memory/1012-133-0x00000000051E0000-0x00000000051EA000-memory.dmpFilesize
40KB
-
memory/1012-134-0x00000000081B0000-0x000000000824C000-memory.dmpFilesize
624KB
-
memory/1012-130-0x0000000000810000-0x00000000008D4000-memory.dmpFilesize
784KB
-
memory/2196-141-0x0000000007D30000-0x0000000007EB2000-memory.dmpFilesize
1.5MB
-
memory/2196-150-0x00000000024E0000-0x00000000025BB000-memory.dmpFilesize
876KB
-
memory/2196-148-0x00000000024E0000-0x00000000025BB000-memory.dmpFilesize
876KB
-
memory/4368-135-0x0000000000000000-mapping.dmp
-
memory/4368-140-0x0000000000F20000-0x0000000000F35000-memory.dmpFilesize
84KB
-
memory/4368-139-0x0000000000F40000-0x000000000128A000-memory.dmpFilesize
3.3MB
-
memory/4368-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4368-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4680-142-0x0000000000000000-mapping.dmp
-
memory/4680-144-0x00000000010B0000-0x00000000010DF000-memory.dmpFilesize
188KB
-
memory/4680-143-0x0000000000D00000-0x0000000000D1F000-memory.dmpFilesize
124KB
-
memory/4680-146-0x0000000002FE0000-0x000000000332A000-memory.dmpFilesize
3.3MB
-
memory/4680-147-0x0000000002F20000-0x0000000002FB4000-memory.dmpFilesize
592KB
-
memory/4680-149-0x00000000010B0000-0x00000000010DF000-memory.dmpFilesize
188KB
-
memory/4924-145-0x0000000000000000-mapping.dmp