Analysis
-
max time kernel
149s -
max time network
182s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
02-10-2021 02:23
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry-URGENT.exe
Resource
win7v20210408
General
-
Target
Inquiry-URGENT.exe
-
Size
617KB
-
MD5
7c347b3aba43cefc31e91fede356961b
-
SHA1
58bb9e282a8d6c95941d310a23010718901c58dd
-
SHA256
c18d5baf727358a8635a51fc7cfb4c3f4c90c78abcecf051feb4540323e98746
-
SHA512
94b6633784c888527aef5e3f4cba9d03b04118f43c0f6222b2c60e756fdb183fe88e9a9d940b95fb3ac2d85bee4a4a681ab8f77f4de85c9a722c8c8da9eaebe9
Malware Config
Extracted
xloader
2.5
b5ce
http://www.rheilea.com/b5ce/
advellerd.xyz
giasuvina.com
arab-xt-pro.com
ahsltu2ua4.com
trasportesemmanuel.com
kissimmeesoccercup.com
studyengland.com
m2volleyballclub.com
shyuehuan.com
elsml.com
blog-x-history.top
coditeu.com
allattachments.net
vigautruc.com
mentication.com
zambiaedu.xyz
filadelfiacenter.com
avlaborsourceinc.info
tameka-stewart.com
studio-cleo.com
cruisebookingsonlineukweb.com
bajajfinservmutualfund.com
bipxtech.cloud
glottogon.com
villamante.com
lvfrm.xyz
bhadanamedia.digital
austindemolitioncontractor.com
nutritionhawks.com
vcmalihx.top
busybstickerco.com
lianshangtron.com
tenncreative.com
charmfulland.com
zuridesire.com
vliegenmetplezier.com
khlopok.club
tovardarom.xyz
atmospheraglobal.com
lakeefctmich.com
novasaude-g1.online
joymort.com
allexceptionalcapital.com
balicoffeeuniversal.com
netjyjin26.net
arpdomestic.com
ozglobetips.online
zeogg.club
josiemaran-supernatural.com
sieuthinhapkhau.store
healthonline.store
coiincrypt.com
fofija.com
yshowmedia.com
enhancedcr.com
tous-des-cons.club
holeinthewallbus.com
okssl.net
gutenstocks.com
thelindleyfamily.com
apexpropertiesltd.com
powerhousetepusa.com
urbanopportunities.com
comarch.tech
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1880-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1880-67-0x000000000041D430-mapping.dmp xloader behavioral1/memory/1440-74-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1620 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Inquiry-URGENT.exeInquiry-URGENT.exemsiexec.exedescription pid process target process PID 1860 set thread context of 1880 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1880 set thread context of 1228 1880 Inquiry-URGENT.exe Explorer.EXE PID 1440 set thread context of 1228 1440 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Inquiry-URGENT.exeInquiry-URGENT.exemsiexec.exepid process 1860 Inquiry-URGENT.exe 1880 Inquiry-URGENT.exe 1880 Inquiry-URGENT.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe 1440 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Inquiry-URGENT.exemsiexec.exepid process 1880 Inquiry-URGENT.exe 1880 Inquiry-URGENT.exe 1880 Inquiry-URGENT.exe 1440 msiexec.exe 1440 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Inquiry-URGENT.exeInquiry-URGENT.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1860 Inquiry-URGENT.exe Token: SeDebugPrivilege 1880 Inquiry-URGENT.exe Token: SeDebugPrivilege 1440 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Inquiry-URGENT.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1860 wrote to memory of 1868 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1868 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1868 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1868 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1880 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1880 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1880 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1880 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1880 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1880 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1860 wrote to memory of 1880 1860 Inquiry-URGENT.exe Inquiry-URGENT.exe PID 1228 wrote to memory of 1440 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1440 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1440 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1440 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1440 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1440 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1440 1228 Explorer.EXE msiexec.exe PID 1440 wrote to memory of 1620 1440 msiexec.exe cmd.exe PID 1440 wrote to memory of 1620 1440 msiexec.exe cmd.exe PID 1440 wrote to memory of 1620 1440 msiexec.exe cmd.exe PID 1440 wrote to memory of 1620 1440 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1228-70-0x00000000041A0000-0x000000000428E000-memory.dmpFilesize
952KB
-
memory/1228-78-0x0000000004F40000-0x0000000005085000-memory.dmpFilesize
1.3MB
-
memory/1440-77-0x0000000001DD0000-0x0000000001E60000-memory.dmpFilesize
576KB
-
memory/1440-73-0x00000000009B0000-0x00000000009C4000-memory.dmpFilesize
80KB
-
memory/1440-75-0x0000000002270000-0x0000000002573000-memory.dmpFilesize
3.0MB
-
memory/1440-74-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1440-72-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/1440-71-0x0000000000000000-mapping.dmp
-
memory/1620-76-0x0000000000000000-mapping.dmp
-
memory/1860-65-0x0000000002010000-0x000000000203C000-memory.dmpFilesize
176KB
-
memory/1860-60-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1860-64-0x0000000004CA0000-0x0000000004CFC000-memory.dmpFilesize
368KB
-
memory/1860-63-0x0000000000320000-0x0000000000326000-memory.dmpFilesize
24KB
-
memory/1860-62-0x0000000004400000-0x0000000004401000-memory.dmpFilesize
4KB
-
memory/1880-68-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/1880-69-0x0000000000390000-0x00000000003A1000-memory.dmpFilesize
68KB
-
memory/1880-67-0x000000000041D430-mapping.dmp
-
memory/1880-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB