Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7 - submitted
24/06/2020, 15:10
Static task
static1
Behavioral task
behavioral1
Sample
RFQ19202006.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ19202006.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target RFQ19202006.exe
- Size 345KB
- Sample200624-2qhvrtmf4x
- SHA256 ede6df4a8c12ce93266ac2c5ace537e336600a441aa5a271829a5013e8fa20c0
- MD5 14cdccd16537e37c842cc64dd17c17b6
- SHA1 8dac74d725c9965996c59b2d383d47728087e214
- SHA512 429e6ae349791689cdc8a03ab7cbbb02576e899662de072894f9a8a99a89188a96c9cc42964f8786ab7bf478af2e97c350ba9d9e3d2395d2e70af1fae831fc98
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1440 1072 RFQ19202006.exe 24 PID 1072 wrote to memory of 1440 1072 RFQ19202006.exe 24 PID 1072 wrote to memory of 1440 1072 RFQ19202006.exe 24 PID 1072 wrote to memory of 1440 1072 RFQ19202006.exe 24 PID 1072 wrote to memory of 1440 1072 RFQ19202006.exe 24 PID 1072 wrote to memory of 1440 1072 RFQ19202006.exe 24 PID 1072 wrote to memory of 1440 1072 RFQ19202006.exe 24 PID 1324 wrote to memory of 1524 1324 Explorer.EXE 25 PID 1324 wrote to memory of 1524 1324 Explorer.EXE 25 PID 1324 wrote to memory of 1524 1324 Explorer.EXE 25 PID 1324 wrote to memory of 1524 1324 Explorer.EXE 25 PID 1524 wrote to memory of 1116 1524 explorer.exe 26 PID 1524 wrote to memory of 1116 1524 explorer.exe 26 PID 1524 wrote to memory of 1116 1524 explorer.exe 26 PID 1524 wrote to memory of 1116 1524 explorer.exe 26 - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1440 RFQ19202006.exe 1440 RFQ19202006.exe 1440 RFQ19202006.exe 1524 explorer.exe 1524 explorer.exe - Deletes itself 1 IoCs
pid Process 1116 cmd.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1072 set thread context of 1440 1072 RFQ19202006.exe 24 PID 1440 set thread context of 1324 1440 RFQ19202006.exe 20 PID 1524 set thread context of 1324 1524 explorer.exe 20 - Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1440 RFQ19202006.exe 1440 RFQ19202006.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe 1524 explorer.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1440 RFQ19202006.exe Token: SeShutdownPrivilege 1324 Explorer.EXE Token: SeDebugPrivilege 1524 explorer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\RFQ19202006.exe"C:\Users\Admin\AppData\Local\Temp\RFQ19202006.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\RFQ19202006.exe"{path}"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ19202006.exe"3⤵
- Deletes itself
PID:1116
-
-