Analysis
- max time kernel
148s - max time network
70s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
Cona Import Company-RFQ.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Cona Import Company-RFQ.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Cona Import Company-RFQ.exe
- Size 484KB
- Sample200624-5nw8f647qa
- SHA256 cbd6e5626ae84385a9fc7a7eab1877be367ef0b69dc1c4a8de1f668ecb018ab2
- MD5 9184cac2dd7d6a1163b690681323c4bc
- SHA1 6d254fd31b71876ae1528597f47ee24c04b901df
- SHA512 ec4eb0e47df06b685baf81f3954d7ce5dce5f5c9c7006784f3464eaaf5ca439ca0d771ad86f3fc2ffa99edb10f7dd1e89f2818b43632f892600c0368b603a40c
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2916 set thread context of 2700 2916 Cona Import Company-RFQ.exe 72 PID 2700 set thread context of 2988 2700 Cona Import Company-RFQ.exe 56 PID 3000 set thread context of 2988 3000 msdt.exe 56 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2700 Cona Import Company-RFQ.exe 2700 Cona Import Company-RFQ.exe 2700 Cona Import Company-RFQ.exe 2700 Cona Import Company-RFQ.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe 3000 msdt.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2700 Cona Import Company-RFQ.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeDebugPrivilege 3000 msdt.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2700 Cona Import Company-RFQ.exe 2700 Cona Import Company-RFQ.exe 2700 Cona Import Company-RFQ.exe 3000 msdt.exe 3000 msdt.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2700 2916 Cona Import Company-RFQ.exe 72 PID 2916 wrote to memory of 2700 2916 Cona Import Company-RFQ.exe 72 PID 2916 wrote to memory of 2700 2916 Cona Import Company-RFQ.exe 72 PID 2916 wrote to memory of 2700 2916 Cona Import Company-RFQ.exe 72 PID 2916 wrote to memory of 2700 2916 Cona Import Company-RFQ.exe 72 PID 2916 wrote to memory of 2700 2916 Cona Import Company-RFQ.exe 72 PID 2988 wrote to memory of 3000 2988 Explorer.EXE 73 PID 2988 wrote to memory of 3000 2988 Explorer.EXE 73 PID 2988 wrote to memory of 3000 2988 Explorer.EXE 73 PID 3000 wrote to memory of 3740 3000 msdt.exe 74 PID 3000 wrote to memory of 3740 3000 msdt.exe 74 PID 3000 wrote to memory of 3740 3000 msdt.exe 74
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\Cona Import Company-RFQ.exe"C:\Users\Admin\AppData\Local\Temp\Cona Import Company-RFQ.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\Cona Import Company-RFQ.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:2700
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Cona Import Company-RFQ.exe"3⤵PID:3740
-
-