Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
27-09-2021 09:20
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry Order 26-09-2021.exe
Resource
win7-en-20210920
General
-
Target
Inquiry Order 26-09-2021.exe
-
Size
818KB
-
MD5
0bbbecc3323e753a087a19b3cc4edabd
-
SHA1
b96d8e6c3278698624e228f09de44815b1d90905
-
SHA256
c4c9d27ea805c32e7f0e66dc0d9534d8fbd87f4c1327727b2e1e9ae937f02c45
-
SHA512
054e82894d5a1974de958460a30ca7be4fd1395304900a8f5859c9cb5a98a6bf9e8848445f80c5a2b512f1579734111aff2782470111250723aaf7291a9733d5
Malware Config
Extracted
xloader
2.5
b5ce
http://www.rheilea.com/b5ce/
advellerd.xyz
giasuvina.com
arab-xt-pro.com
ahsltu2ua4.com
trasportesemmanuel.com
kissimmeesoccercup.com
studyengland.com
m2volleyballclub.com
shyuehuan.com
elsml.com
blog-x-history.top
coditeu.com
allattachments.net
vigautruc.com
mentication.com
zambiaedu.xyz
filadelfiacenter.com
avlaborsourceinc.info
tameka-stewart.com
studio-cleo.com
cruisebookingsonlineukweb.com
bajajfinservmutualfund.com
bipxtech.cloud
glottogon.com
villamante.com
lvfrm.xyz
bhadanamedia.digital
austindemolitioncontractor.com
nutritionhawks.com
vcmalihx.top
busybstickerco.com
lianshangtron.com
tenncreative.com
charmfulland.com
zuridesire.com
vliegenmetplezier.com
khlopok.club
tovardarom.xyz
atmospheraglobal.com
lakeefctmich.com
novasaude-g1.online
joymort.com
allexceptionalcapital.com
balicoffeeuniversal.com
netjyjin26.net
arpdomestic.com
ozglobetips.online
zeogg.club
josiemaran-supernatural.com
sieuthinhapkhau.store
healthonline.store
coiincrypt.com
fofija.com
yshowmedia.com
enhancedcr.com
tous-des-cons.club
holeinthewallbus.com
okssl.net
gutenstocks.com
thelindleyfamily.com
apexpropertiesltd.com
powerhousetepusa.com
urbanopportunities.com
comarch.tech
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/984-59-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/984-60-0x000000000041D430-mapping.dmp xloader behavioral1/memory/1900-70-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 592 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Inquiry Order 26-09-2021.exeInquiry Order 26-09-2021.execmstp.exedescription pid process target process PID 1216 set thread context of 984 1216 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 984 set thread context of 1268 984 Inquiry Order 26-09-2021.exe Explorer.EXE PID 984 set thread context of 1268 984 Inquiry Order 26-09-2021.exe Explorer.EXE PID 1900 set thread context of 1268 1900 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Inquiry Order 26-09-2021.execmstp.exepid process 984 Inquiry Order 26-09-2021.exe 984 Inquiry Order 26-09-2021.exe 984 Inquiry Order 26-09-2021.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe 1900 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Inquiry Order 26-09-2021.execmstp.exepid process 984 Inquiry Order 26-09-2021.exe 984 Inquiry Order 26-09-2021.exe 984 Inquiry Order 26-09-2021.exe 984 Inquiry Order 26-09-2021.exe 1900 cmstp.exe 1900 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Inquiry Order 26-09-2021.execmstp.exedescription pid process Token: SeDebugPrivilege 984 Inquiry Order 26-09-2021.exe Token: SeDebugPrivilege 1900 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Inquiry Order 26-09-2021.exeExplorer.EXEcmstp.exedescription pid process target process PID 1216 wrote to memory of 984 1216 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 1216 wrote to memory of 984 1216 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 1216 wrote to memory of 984 1216 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 1216 wrote to memory of 984 1216 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 1216 wrote to memory of 984 1216 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 1216 wrote to memory of 984 1216 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 1216 wrote to memory of 984 1216 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 1268 wrote to memory of 1900 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 1900 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 1900 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 1900 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 1900 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 1900 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 1900 1268 Explorer.EXE cmstp.exe PID 1900 wrote to memory of 592 1900 cmstp.exe cmd.exe PID 1900 wrote to memory of 592 1900 cmstp.exe cmd.exe PID 1900 wrote to memory of 592 1900 cmstp.exe cmd.exe PID 1900 wrote to memory of 592 1900 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-71-0x0000000000000000-mapping.dmp
-
memory/984-64-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/984-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/984-60-0x000000000041D430-mapping.dmp
-
memory/984-62-0x0000000000150000-0x0000000000161000-memory.dmpFilesize
68KB
-
memory/984-61-0x0000000000B80000-0x0000000000E83000-memory.dmpFilesize
3.0MB
-
memory/1216-55-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/1216-53-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1216-58-0x0000000001EF0000-0x0000000001F1F000-memory.dmpFilesize
188KB
-
memory/1216-57-0x0000000004EA0000-0x0000000004EFE000-memory.dmpFilesize
376KB
-
memory/1216-56-0x00000000003C0000-0x00000000003C7000-memory.dmpFilesize
28KB
-
memory/1268-73-0x00000000040C0000-0x000000000415E000-memory.dmpFilesize
632KB
-
memory/1268-65-0x0000000004E70000-0x0000000004F2B000-memory.dmpFilesize
748KB
-
memory/1268-63-0x00000000067F0000-0x00000000068D1000-memory.dmpFilesize
900KB
-
memory/1900-67-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1900-68-0x00000000004C0000-0x00000000004D8000-memory.dmpFilesize
96KB
-
memory/1900-69-0x0000000001F90000-0x0000000002293000-memory.dmpFilesize
3.0MB
-
memory/1900-70-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1900-66-0x0000000000000000-mapping.dmp
-
memory/1900-72-0x0000000001E00000-0x0000000001E90000-memory.dmpFilesize
576KB