Analysis
-
max time kernel
162s -
max time network
176s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 16:05
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry 21.1.2021.exe
Resource
win7-en-20211208
General
-
Target
Inquiry 21.1.2021.exe
-
Size
800KB
-
MD5
059c56876497cfe76c5fd67bb83fd8a6
-
SHA1
d0c8bcffd9a9393e02afa12d0d1d6da3f5ae5426
-
SHA256
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4
-
SHA512
06ce3b9bb8d3c80efae131ec7c5c17168f2ca78b177e94c79b1ef3b36d8b8ab87c1da86468419017aaf34cdcf45e71a6666715014a5d3a5811194939367dfcd5
Malware Config
Extracted
xloader
2.3
kio8
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
smallcoloradoweddings.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1700-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1700-127-0x0000000000E10000-0x0000000000F5A000-memory.dmp xloader behavioral2/memory/1700-129-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3352-133-0x0000000000420000-0x0000000000449000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Inquiry 21.1.2021.exeInquiry 21.1.2021.exesystray.exedescription pid process target process PID 1020 set thread context of 1700 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1700 set thread context of 2928 1700 Inquiry 21.1.2021.exe Explorer.EXE PID 1700 set thread context of 2928 1700 Inquiry 21.1.2021.exe Explorer.EXE PID 3352 set thread context of 2928 3352 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
Inquiry 21.1.2021.exeInquiry 21.1.2021.exesystray.exepid process 1020 Inquiry 21.1.2021.exe 1020 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe 3352 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2928 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Inquiry 21.1.2021.exesystray.exepid process 1700 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 1700 Inquiry 21.1.2021.exe 3352 systray.exe 3352 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Inquiry 21.1.2021.exeInquiry 21.1.2021.exesystray.exedescription pid process Token: SeDebugPrivilege 1020 Inquiry 21.1.2021.exe Token: SeDebugPrivilege 1700 Inquiry 21.1.2021.exe Token: SeDebugPrivilege 3352 systray.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Inquiry 21.1.2021.exeExplorer.EXEsystray.exedescription pid process target process PID 1020 wrote to memory of 1648 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1020 wrote to memory of 1648 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1020 wrote to memory of 1648 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1020 wrote to memory of 1700 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1020 wrote to memory of 1700 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1020 wrote to memory of 1700 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1020 wrote to memory of 1700 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1020 wrote to memory of 1700 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 1020 wrote to memory of 1700 1020 Inquiry 21.1.2021.exe Inquiry 21.1.2021.exe PID 2928 wrote to memory of 3352 2928 Explorer.EXE systray.exe PID 2928 wrote to memory of 3352 2928 Explorer.EXE systray.exe PID 2928 wrote to memory of 3352 2928 Explorer.EXE systray.exe PID 3352 wrote to memory of 608 3352 systray.exe cmd.exe PID 3352 wrote to memory of 608 3352 systray.exe cmd.exe PID 3352 wrote to memory of 608 3352 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inquiry 21.1.2021.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1020-115-0x0000000000430000-0x00000000004FE000-memory.dmpFilesize
824KB
-
memory/1020-116-0x0000000004E80000-0x0000000004F1C000-memory.dmpFilesize
624KB
-
memory/1020-117-0x0000000005420000-0x000000000591E000-memory.dmpFilesize
5.0MB
-
memory/1020-118-0x0000000004FC0000-0x0000000005052000-memory.dmpFilesize
584KB
-
memory/1020-119-0x0000000004E40000-0x0000000004E4A000-memory.dmpFilesize
40KB
-
memory/1020-120-0x0000000005120000-0x0000000005176000-memory.dmpFilesize
344KB
-
memory/1020-121-0x0000000004F20000-0x000000000541E000-memory.dmpFilesize
5.0MB
-
memory/1020-122-0x0000000005BD0000-0x0000000005BF8000-memory.dmpFilesize
160KB
-
memory/1020-123-0x0000000000DE0000-0x0000000000E4E000-memory.dmpFilesize
440KB
-
memory/1700-127-0x0000000000E10000-0x0000000000F5A000-memory.dmpFilesize
1.3MB
-
memory/1700-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1700-126-0x0000000001270000-0x0000000001590000-memory.dmpFilesize
3.1MB
-
memory/1700-129-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1700-130-0x00000000010D0000-0x0000000001269000-memory.dmpFilesize
1.6MB
-
memory/2928-128-0x0000000000670000-0x0000000000734000-memory.dmpFilesize
784KB
-
memory/2928-131-0x0000000001FE0000-0x000000000208F000-memory.dmpFilesize
700KB
-
memory/2928-136-0x0000000005F40000-0x0000000006052000-memory.dmpFilesize
1.1MB
-
memory/3352-133-0x0000000000420000-0x0000000000449000-memory.dmpFilesize
164KB
-
memory/3352-132-0x0000000000840000-0x0000000000846000-memory.dmpFilesize
24KB
-
memory/3352-134-0x0000000004330000-0x0000000004650000-memory.dmpFilesize
3.1MB
-
memory/3352-135-0x0000000004190000-0x000000000432F000-memory.dmpFilesize
1.6MB