Analysis
- max time kernel
145s - max time network
147s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 15:10
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-PO#40062.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ-PO#40062.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target RFQ-PO#40062.exe
- Size 505KB
- Sample200624-pl2fexlk2e
- SHA256 528855cf41335ffa3099457ea280c63afba531ec224b3c3ee9eb293b369db220
- MD5 d7fe417e0330a172af1bce5d99e9e1cd
- SHA1 1ee040a6168532f78584e51bc07e3df2fc1ae796
- SHA512 1257b0a6aa3594c06894963475254061bc239a0911d76eca392b37d484954670750e9ca82e5041e94c1ba7747ffb8c146e0378a8c9bb0544cc0bb3ca186aa6bb
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3068 set thread context of 3820 3068 RFQ-PO#40062.exe 68 PID 3820 set thread context of 3016 3820 RFQ-PO#40062.exe 56 PID 3464 set thread context of 3016 3464 control.exe 56 - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3820 RFQ-PO#40062.exe 3820 RFQ-PO#40062.exe 3820 RFQ-PO#40062.exe 3464 control.exe 3464 control.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3016 Explorer.EXE 3016 Explorer.EXE - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run control.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XNMXBTIXPV = "C:\\Program Files (x86)\\Arpxl300h\\user7nmtan.exe" control.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3068 wrote to memory of 3840 3068 RFQ-PO#40062.exe 67 PID 3068 wrote to memory of 3840 3068 RFQ-PO#40062.exe 67 PID 3068 wrote to memory of 3840 3068 RFQ-PO#40062.exe 67 PID 3068 wrote to memory of 3820 3068 RFQ-PO#40062.exe 68 PID 3068 wrote to memory of 3820 3068 RFQ-PO#40062.exe 68 PID 3068 wrote to memory of 3820 3068 RFQ-PO#40062.exe 68 PID 3068 wrote to memory of 3820 3068 RFQ-PO#40062.exe 68 PID 3068 wrote to memory of 3820 3068 RFQ-PO#40062.exe 68 PID 3068 wrote to memory of 3820 3068 RFQ-PO#40062.exe 68 PID 3016 wrote to memory of 3464 3016 Explorer.EXE 74 PID 3016 wrote to memory of 3464 3016 Explorer.EXE 74 PID 3016 wrote to memory of 3464 3016 Explorer.EXE 74 PID 3464 wrote to memory of 3496 3464 control.exe 75 PID 3464 wrote to memory of 3496 3464 control.exe 75 PID 3464 wrote to memory of 3496 3464 control.exe 75 PID 3464 wrote to memory of 1304 3464 control.exe 83 PID 3464 wrote to memory of 1304 3464 control.exe 83 PID 3464 wrote to memory of 1304 3464 control.exe 83 - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3068 RFQ-PO#40062.exe 3068 RFQ-PO#40062.exe 3820 RFQ-PO#40062.exe 3820 RFQ-PO#40062.exe 3820 RFQ-PO#40062.exe 3820 RFQ-PO#40062.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe 3464 control.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3016 Explorer.EXE 3016 Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Arpxl300h\user7nmtan.exe control.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer control.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3068 RFQ-PO#40062.exe Token: SeDebugPrivilege 3820 RFQ-PO#40062.exe Token: SeDebugPrivilege 3464 control.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\RFQ-PO#40062.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-PO#40062.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\RFQ-PO#40062.exe"{path}"3⤵PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ-PO#40062.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3792
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1840
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1488
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3520
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3000
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- System policy modification
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:3464 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ-PO#40062.exe"3⤵PID:3496
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1304
-
-