Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-09-2021 09:20
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry Order 26-09-2021.exe
Resource
win7-en-20210920
General
-
Target
Inquiry Order 26-09-2021.exe
-
Size
818KB
-
MD5
0bbbecc3323e753a087a19b3cc4edabd
-
SHA1
b96d8e6c3278698624e228f09de44815b1d90905
-
SHA256
c4c9d27ea805c32e7f0e66dc0d9534d8fbd87f4c1327727b2e1e9ae937f02c45
-
SHA512
054e82894d5a1974de958460a30ca7be4fd1395304900a8f5859c9cb5a98a6bf9e8848445f80c5a2b512f1579734111aff2782470111250723aaf7291a9733d5
Malware Config
Extracted
xloader
2.5
b5ce
http://www.rheilea.com/b5ce/
advellerd.xyz
giasuvina.com
arab-xt-pro.com
ahsltu2ua4.com
trasportesemmanuel.com
kissimmeesoccercup.com
studyengland.com
m2volleyballclub.com
shyuehuan.com
elsml.com
blog-x-history.top
coditeu.com
allattachments.net
vigautruc.com
mentication.com
zambiaedu.xyz
filadelfiacenter.com
avlaborsourceinc.info
tameka-stewart.com
studio-cleo.com
cruisebookingsonlineukweb.com
bajajfinservmutualfund.com
bipxtech.cloud
glottogon.com
villamante.com
lvfrm.xyz
bhadanamedia.digital
austindemolitioncontractor.com
nutritionhawks.com
vcmalihx.top
busybstickerco.com
lianshangtron.com
tenncreative.com
charmfulland.com
zuridesire.com
vliegenmetplezier.com
khlopok.club
tovardarom.xyz
atmospheraglobal.com
lakeefctmich.com
novasaude-g1.online
joymort.com
allexceptionalcapital.com
balicoffeeuniversal.com
netjyjin26.net
arpdomestic.com
ozglobetips.online
zeogg.club
josiemaran-supernatural.com
sieuthinhapkhau.store
healthonline.store
coiincrypt.com
fofija.com
yshowmedia.com
enhancedcr.com
tous-des-cons.club
holeinthewallbus.com
okssl.net
gutenstocks.com
thelindleyfamily.com
apexpropertiesltd.com
powerhousetepusa.com
urbanopportunities.com
comarch.tech
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/372-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/372-126-0x000000000041D430-mapping.dmp xloader behavioral2/memory/1324-132-0x0000000000810000-0x0000000000839000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
cmd.exeflow pid process 16 1324 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Inquiry Order 26-09-2021.exeInquiry Order 26-09-2021.execmd.exedescription pid process target process PID 532 set thread context of 372 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 372 set thread context of 2988 372 Inquiry Order 26-09-2021.exe Explorer.EXE PID 1324 set thread context of 2988 1324 cmd.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
Inquiry Order 26-09-2021.exeInquiry Order 26-09-2021.execmd.exepid process 532 Inquiry Order 26-09-2021.exe 532 Inquiry Order 26-09-2021.exe 372 Inquiry Order 26-09-2021.exe 372 Inquiry Order 26-09-2021.exe 372 Inquiry Order 26-09-2021.exe 372 Inquiry Order 26-09-2021.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe 1324 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2988 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Inquiry Order 26-09-2021.execmd.exepid process 372 Inquiry Order 26-09-2021.exe 372 Inquiry Order 26-09-2021.exe 372 Inquiry Order 26-09-2021.exe 1324 cmd.exe 1324 cmd.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Inquiry Order 26-09-2021.exeInquiry Order 26-09-2021.exeExplorer.EXEcmd.exedescription pid process Token: SeDebugPrivilege 532 Inquiry Order 26-09-2021.exe Token: SeDebugPrivilege 372 Inquiry Order 26-09-2021.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeDebugPrivilege 1324 cmd.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
Explorer.EXEpid process 2988 Explorer.EXE 2988 Explorer.EXE 2988 Explorer.EXE 2988 Explorer.EXE 2988 Explorer.EXE 2988 Explorer.EXE 2988 Explorer.EXE 2988 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2988 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Inquiry Order 26-09-2021.exeExplorer.EXEcmd.exedescription pid process target process PID 532 wrote to memory of 400 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 532 wrote to memory of 400 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 532 wrote to memory of 400 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 532 wrote to memory of 372 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 532 wrote to memory of 372 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 532 wrote to memory of 372 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 532 wrote to memory of 372 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 532 wrote to memory of 372 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 532 wrote to memory of 372 532 Inquiry Order 26-09-2021.exe Inquiry Order 26-09-2021.exe PID 2988 wrote to memory of 1324 2988 Explorer.EXE cmd.exe PID 2988 wrote to memory of 1324 2988 Explorer.EXE cmd.exe PID 2988 wrote to memory of 1324 2988 Explorer.EXE cmd.exe PID 1324 wrote to memory of 2816 1324 cmd.exe cmd.exe PID 1324 wrote to memory of 2816 1324 cmd.exe cmd.exe PID 1324 wrote to memory of 2816 1324 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/372-127-0x0000000001820000-0x0000000001B40000-memory.dmpFilesize
3.1MB
-
memory/372-128-0x0000000001C50000-0x0000000001C61000-memory.dmpFilesize
68KB
-
memory/372-126-0x000000000041D430-mapping.dmp
-
memory/532-120-0x0000000008800000-0x0000000008801000-memory.dmpFilesize
4KB
-
memory/532-116-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/532-121-0x00000000054F0000-0x00000000054F7000-memory.dmpFilesize
28KB
-
memory/532-122-0x0000000008E80000-0x0000000008E81000-memory.dmpFilesize
4KB
-
memory/532-123-0x0000000008D40000-0x0000000008D9E000-memory.dmpFilesize
376KB
-
memory/532-124-0x0000000008DB0000-0x0000000008DDF000-memory.dmpFilesize
188KB
-
memory/532-119-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/532-118-0x0000000005310000-0x000000000580E000-memory.dmpFilesize
5.0MB
-
memory/532-117-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/532-114-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/1324-130-0x0000000000000000-mapping.dmp
-
memory/1324-131-0x00000000008C0000-0x0000000000919000-memory.dmpFilesize
356KB
-
memory/1324-132-0x0000000000810000-0x0000000000839000-memory.dmpFilesize
164KB
-
memory/1324-133-0x00000000031E0000-0x0000000003500000-memory.dmpFilesize
3.1MB
-
memory/1324-135-0x0000000003000000-0x0000000003090000-memory.dmpFilesize
576KB
-
memory/2816-134-0x0000000000000000-mapping.dmp
-
memory/2988-129-0x0000000000B50000-0x0000000000C0E000-memory.dmpFilesize
760KB
-
memory/2988-136-0x00000000050E0000-0x00000000051F4000-memory.dmpFilesize
1.1MB