Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 05:27
Static task
static1
Behavioral task
behavioral1
Sample
Wellis Inquiry.exe
Resource
win7-en-20210920
General
-
Target
Wellis Inquiry.exe
-
Size
329KB
-
MD5
c357a8010e661a49df2e813bd22590b6
-
SHA1
08ecd005e1449ec97d0405e83649686ae35f6286
-
SHA256
eef137583da6deb4a1be9882cede6cec5112b74ae79c0773f45b13346c5b2890
-
SHA512
71957a0cd597213808b15b1abe9ce3df07889627b4a1b849362df07de6da3984803c6b2e6487338375a558dc9c1f0db32aee42fde89cee305078c22d6b92890e
Malware Config
Extracted
xloader
2.5
ag9v
http://www.psychedeliccosmetics.com/ag9v/
wordmagicshow.com
dogparkdate.com
quickcarehomeopathic.com
azwar.net
louisle1909.xyz
section8lv.com
felineness.com
2888sy.com
wadashoot.com
kittyuniverse.com
blushroses.com
alaskangeneral.com
yumoo.design
7xkfic.com
891827.com
uspress1.com
aceserial.xyz
muellerconfidence.com
eramakport.com
tipsandtoesnewton.com
withph.net
kravesproet.quest
restaurantemesana.com
ghostpunk.art
cobere9.com
darshanshastra.com
barnhsartcrane.com
richartware.com
welcomprom2.com
plantvsundeadhelp.com
hotsatisfy.com
fullhindimovies.com
beautynaturalcosmeticslk.com
googglo.com
hongyang98.com
elishevazz.com
ebookgratis.online
urbanyinyoga.com
sojuicybar.com
seheon.email
pokemongosrf.com
catchytravel.com
stonecoldice.net
betinle137.com
platinumridge.art
agoodhotel.com
preventbiotech.com
ebonyslivestockservice.online
billionairesboat.com
dollpartyla.com
naufragant.com
cat2628.top
ietwatiomlan.quest
soulful-simplicity.com
kalmmed.com
luxuryray.com
pknox.net
687410.com
blackmagiccomics.com
usaworkerscorporation.com
ovmfinacial.com
marunouchi1.com
feshwal.com
qupontgon.quest
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/360-62-0x000000000041D490-mapping.dmp xloader behavioral1/memory/360-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1728-69-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1760 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Wellis Inquiry.exeWellis Inquiry.exeNETSTAT.EXEdescription pid process target process PID 2004 set thread context of 360 2004 Wellis Inquiry.exe Wellis Inquiry.exe PID 360 set thread context of 1384 360 Wellis Inquiry.exe Explorer.EXE PID 1728 set thread context of 1384 1728 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1728 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Wellis Inquiry.exeNETSTAT.EXEpid process 360 Wellis Inquiry.exe 360 Wellis Inquiry.exe 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE 1728 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Wellis Inquiry.exeNETSTAT.EXEpid process 360 Wellis Inquiry.exe 360 Wellis Inquiry.exe 360 Wellis Inquiry.exe 1728 NETSTAT.EXE 1728 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Wellis Inquiry.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 360 Wellis Inquiry.exe Token: SeDebugPrivilege 1728 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Wellis Inquiry.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 2004 wrote to memory of 360 2004 Wellis Inquiry.exe Wellis Inquiry.exe PID 2004 wrote to memory of 360 2004 Wellis Inquiry.exe Wellis Inquiry.exe PID 2004 wrote to memory of 360 2004 Wellis Inquiry.exe Wellis Inquiry.exe PID 2004 wrote to memory of 360 2004 Wellis Inquiry.exe Wellis Inquiry.exe PID 2004 wrote to memory of 360 2004 Wellis Inquiry.exe Wellis Inquiry.exe PID 2004 wrote to memory of 360 2004 Wellis Inquiry.exe Wellis Inquiry.exe PID 2004 wrote to memory of 360 2004 Wellis Inquiry.exe Wellis Inquiry.exe PID 1384 wrote to memory of 1728 1384 Explorer.EXE NETSTAT.EXE PID 1384 wrote to memory of 1728 1384 Explorer.EXE NETSTAT.EXE PID 1384 wrote to memory of 1728 1384 Explorer.EXE NETSTAT.EXE PID 1384 wrote to memory of 1728 1384 Explorer.EXE NETSTAT.EXE PID 1728 wrote to memory of 1760 1728 NETSTAT.EXE cmd.exe PID 1728 wrote to memory of 1760 1728 NETSTAT.EXE cmd.exe PID 1728 wrote to memory of 1760 1728 NETSTAT.EXE cmd.exe PID 1728 wrote to memory of 1760 1728 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/360-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/360-64-0x00000000009A0000-0x0000000000CA3000-memory.dmpFilesize
3.0MB
-
memory/360-65-0x0000000000290000-0x00000000002A1000-memory.dmpFilesize
68KB
-
memory/360-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/360-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/360-62-0x000000000041D490-mapping.dmp
-
memory/1384-73-0x0000000004800000-0x00000000048D4000-memory.dmpFilesize
848KB
-
memory/1384-66-0x0000000007320000-0x000000000749A000-memory.dmpFilesize
1.5MB
-
memory/1728-67-0x0000000000000000-mapping.dmp
-
memory/1728-68-0x0000000000090000-0x0000000000099000-memory.dmpFilesize
36KB
-
memory/1728-69-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1728-71-0x0000000002120000-0x0000000002423000-memory.dmpFilesize
3.0MB
-
memory/1728-72-0x0000000001FA0000-0x0000000002030000-memory.dmpFilesize
576KB
-
memory/1760-70-0x0000000000000000-mapping.dmp
-
memory/2004-58-0x0000000004BC0000-0x0000000004C0B000-memory.dmpFilesize
300KB
-
memory/2004-57-0x00000000004A0000-0x00000000004A5000-memory.dmpFilesize
20KB
-
memory/2004-56-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/2004-53-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/2004-55-0x0000000075C11000-0x0000000075C13000-memory.dmpFilesize
8KB