Analysis
-
max time kernel
154s -
max time network
156s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-10-2021 05:27
Static task
static1
Behavioral task
behavioral1
Sample
Wellis Inquiry.exe
Resource
win7-en-20210920
General
-
Target
Wellis Inquiry.exe
-
Size
329KB
-
MD5
c357a8010e661a49df2e813bd22590b6
-
SHA1
08ecd005e1449ec97d0405e83649686ae35f6286
-
SHA256
eef137583da6deb4a1be9882cede6cec5112b74ae79c0773f45b13346c5b2890
-
SHA512
71957a0cd597213808b15b1abe9ce3df07889627b4a1b849362df07de6da3984803c6b2e6487338375a558dc9c1f0db32aee42fde89cee305078c22d6b92890e
Malware Config
Extracted
xloader
2.5
ag9v
http://www.psychedeliccosmetics.com/ag9v/
wordmagicshow.com
dogparkdate.com
quickcarehomeopathic.com
azwar.net
louisle1909.xyz
section8lv.com
felineness.com
2888sy.com
wadashoot.com
kittyuniverse.com
blushroses.com
alaskangeneral.com
yumoo.design
7xkfic.com
891827.com
uspress1.com
aceserial.xyz
muellerconfidence.com
eramakport.com
tipsandtoesnewton.com
withph.net
kravesproet.quest
restaurantemesana.com
ghostpunk.art
cobere9.com
darshanshastra.com
barnhsartcrane.com
richartware.com
welcomprom2.com
plantvsundeadhelp.com
hotsatisfy.com
fullhindimovies.com
beautynaturalcosmeticslk.com
googglo.com
hongyang98.com
elishevazz.com
ebookgratis.online
urbanyinyoga.com
sojuicybar.com
seheon.email
pokemongosrf.com
catchytravel.com
stonecoldice.net
betinle137.com
platinumridge.art
agoodhotel.com
preventbiotech.com
ebonyslivestockservice.online
billionairesboat.com
dollpartyla.com
naufragant.com
cat2628.top
ietwatiomlan.quest
soulful-simplicity.com
kalmmed.com
luxuryray.com
pknox.net
687410.com
blackmagiccomics.com
usaworkerscorporation.com
ovmfinacial.com
marunouchi1.com
feshwal.com
qupontgon.quest
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3716-123-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3716-124-0x000000000041D490-mapping.dmp xloader behavioral2/memory/2252-131-0x0000000002800000-0x0000000002829000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Wellis Inquiry.exeWellis Inquiry.exeipconfig.exedescription pid process target process PID 1096 set thread context of 3716 1096 Wellis Inquiry.exe Wellis Inquiry.exe PID 3716 set thread context of 2180 3716 Wellis Inquiry.exe Explorer.EXE PID 2252 set thread context of 2180 2252 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 2252 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
Wellis Inquiry.exeipconfig.exepid process 3716 Wellis Inquiry.exe 3716 Wellis Inquiry.exe 3716 Wellis Inquiry.exe 3716 Wellis Inquiry.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe 2252 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2180 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Wellis Inquiry.exeipconfig.exepid process 3716 Wellis Inquiry.exe 3716 Wellis Inquiry.exe 3716 Wellis Inquiry.exe 2252 ipconfig.exe 2252 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Wellis Inquiry.exeipconfig.exedescription pid process Token: SeDebugPrivilege 3716 Wellis Inquiry.exe Token: SeDebugPrivilege 2252 ipconfig.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2180 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Wellis Inquiry.exeExplorer.EXEipconfig.exedescription pid process target process PID 1096 wrote to memory of 3716 1096 Wellis Inquiry.exe Wellis Inquiry.exe PID 1096 wrote to memory of 3716 1096 Wellis Inquiry.exe Wellis Inquiry.exe PID 1096 wrote to memory of 3716 1096 Wellis Inquiry.exe Wellis Inquiry.exe PID 1096 wrote to memory of 3716 1096 Wellis Inquiry.exe Wellis Inquiry.exe PID 1096 wrote to memory of 3716 1096 Wellis Inquiry.exe Wellis Inquiry.exe PID 1096 wrote to memory of 3716 1096 Wellis Inquiry.exe Wellis Inquiry.exe PID 2180 wrote to memory of 2252 2180 Explorer.EXE ipconfig.exe PID 2180 wrote to memory of 2252 2180 Explorer.EXE ipconfig.exe PID 2180 wrote to memory of 2252 2180 Explorer.EXE ipconfig.exe PID 2252 wrote to memory of 3012 2252 ipconfig.exe cmd.exe PID 2252 wrote to memory of 3012 2252 ipconfig.exe cmd.exe PID 2252 wrote to memory of 3012 2252 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Wellis Inquiry.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-116-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/1096-117-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/1096-118-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/1096-119-0x0000000005000000-0x00000000054FE000-memory.dmpFilesize
5.0MB
-
memory/1096-120-0x0000000005290000-0x0000000005295000-memory.dmpFilesize
20KB
-
memory/1096-121-0x00000000075F0000-0x00000000075F1000-memory.dmpFilesize
4KB
-
memory/1096-122-0x0000000006CE0000-0x0000000006D2B000-memory.dmpFilesize
300KB
-
memory/1096-114-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/2180-128-0x0000000005660000-0x00000000057C3000-memory.dmpFilesize
1.4MB
-
memory/2180-135-0x00000000057D0000-0x00000000058F5000-memory.dmpFilesize
1.1MB
-
memory/2252-131-0x0000000002800000-0x0000000002829000-memory.dmpFilesize
164KB
-
memory/2252-129-0x0000000000000000-mapping.dmp
-
memory/2252-130-0x0000000000360000-0x000000000036B000-memory.dmpFilesize
44KB
-
memory/2252-133-0x0000000002E10000-0x0000000003130000-memory.dmpFilesize
3.1MB
-
memory/2252-134-0x0000000002B60000-0x0000000002BF0000-memory.dmpFilesize
576KB
-
memory/3012-132-0x0000000000000000-mapping.dmp
-
memory/3716-126-0x0000000001A30000-0x0000000001D50000-memory.dmpFilesize
3.1MB
-
memory/3716-127-0x00000000019F0000-0x0000000001A01000-memory.dmpFilesize
68KB
-
memory/3716-124-0x000000000041D490-mapping.dmp
-
memory/3716-123-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB