Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 16:05
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry 21.1.2021.exe
Resource
win7-en-20211208
General
-
Target
Inquiry 21.1.2021.exe
-
Size
800KB
-
MD5
059c56876497cfe76c5fd67bb83fd8a6
-
SHA1
d0c8bcffd9a9393e02afa12d0d1d6da3f5ae5426
-
SHA256
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4
-
SHA512
06ce3b9bb8d3c80efae131ec7c5c17168f2ca78b177e94c79b1ef3b36d8b8ab87c1da86468419017aaf34cdcf45e71a6666715014a5d3a5811194939367dfcd5
Malware Config
Extracted
xloader
2.3
kio8
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
smallcoloradoweddings.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1096-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/980-67-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1872 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Inquiry 21.1.2021.exeInquiry 21.1.2021.execmmon32.exedescription pid process target process PID 1580 set thread context of 1096 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1096 set thread context of 1228 1096 Inquiry 21.1.2021.exe Explorer.EXE PID 980 set thread context of 1228 980 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
Inquiry 21.1.2021.exeInquiry 21.1.2021.execmmon32.exepid process 1580 Inquiry 21.1.2021.exe 1096 Inquiry 21.1.2021.exe 1096 Inquiry 21.1.2021.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe 980 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Inquiry 21.1.2021.execmmon32.exepid process 1096 Inquiry 21.1.2021.exe 1096 Inquiry 21.1.2021.exe 1096 Inquiry 21.1.2021.exe 980 cmmon32.exe 980 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Inquiry 21.1.2021.exeInquiry 21.1.2021.execmmon32.exedescription pid process Token: SeDebugPrivilege 1580 Inquiry 21.1.2021.exe Token: SeDebugPrivilege 1096 Inquiry 21.1.2021.exe Token: SeDebugPrivilege 980 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Inquiry 21.1.2021.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1580 wrote to memory of 456 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 456 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 456 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 456 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 1096 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 1096 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 1096 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 1096 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 1096 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 1096 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1580 wrote to memory of 1096 1580 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1228 wrote to memory of 980 1228 Explorer.EXE cmmon32.exe PID 1228 wrote to memory of 980 1228 Explorer.EXE cmmon32.exe PID 1228 wrote to memory of 980 1228 Explorer.EXE cmmon32.exe PID 1228 wrote to memory of 980 1228 Explorer.EXE cmmon32.exe PID 980 wrote to memory of 1872 980 cmmon32.exe cmd.exe PID 980 wrote to memory of 1872 980 cmmon32.exe cmd.exe PID 980 wrote to memory of 1872 980 cmmon32.exe cmd.exe PID 980 wrote to memory of 1872 980 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/980-66-0x0000000000300000-0x000000000030D000-memory.dmpFilesize
52KB
-
memory/980-69-0x0000000001D80000-0x0000000001E0F000-memory.dmpFilesize
572KB
-
memory/980-68-0x0000000002050000-0x0000000002353000-memory.dmpFilesize
3.0MB
-
memory/980-67-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1096-63-0x0000000000890000-0x0000000000C93000-memory.dmpFilesize
4.0MB
-
memory/1096-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1096-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1096-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1096-64-0x00000000000B0000-0x00000000000C0000-memory.dmpFilesize
64KB
-
memory/1228-65-0x0000000004200000-0x00000000042FF000-memory.dmpFilesize
1020KB
-
memory/1228-70-0x0000000007310000-0x0000000007484000-memory.dmpFilesize
1.5MB
-
memory/1580-54-0x00000000002C0000-0x000000000038E000-memory.dmpFilesize
824KB
-
memory/1580-58-0x0000000005280000-0x00000000052EE000-memory.dmpFilesize
440KB
-
memory/1580-57-0x0000000000460000-0x0000000000488000-memory.dmpFilesize
160KB
-
memory/1580-56-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/1580-55-0x00000000763F1000-0x00000000763F3000-memory.dmpFilesize
8KB