2686990e01b4d89572990a34ea3ca265a5fec074276972d5fdb4543eb7357cc9

General

Target

Quotation.exe
Size

431KB
MD5

4e6d23f65ea014d6f39b6382a2818abf
SHA1

15e2c5629388e45437ff60fdb1cdb958351755cc
SHA256

2686990e01b4d89572990a34ea3ca265a5fec074276972d5fdb4543eb7357cc9
SHA512

95941a7caa71fc0cd1f85e038b8e898451a93e2f00ea75d4828daf6f6462e08d8c0e92d50220df89fff3fb5bffd8e8f8508ad64e44d21e283f2dbaa9e1044338

Score

7^/10

spyware

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Quotation.exeQuotation.exe

description pid process

Token: SeDebugPrivilege 1388 Quotation.exe
Token: SeDebugPrivilege 1840 Quotation.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Quotation.exeQuotation.exe

pid process

1388 Quotation.exe
1840 Quotation.exe
1840 Quotation.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Quotation.exe

description pid process target process

PID 1388 set thread context of 1840 1388 Quotation.exe Quotation.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1048 schtasks.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	pid	process
Token: SeDebugPrivilege	1388	Quotation.exe
Token: SeDebugPrivilege	1840	Quotation.exe

pid	process
1388	Quotation.exe
1840	Quotation.exe
1840	Quotation.exe

description	pid	process	target process
PID 1388 set thread context of 1840	1388	Quotation.exe	Quotation.exe

pid	process
1048	schtasks.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Quotation.exe

description	pid	process	target process
PID 1388 wrote to memory of 1048	1388	Quotation.exe	schtasks.exe
PID 1388 wrote to memory of 1048	1388	Quotation.exe	schtasks.exe
PID 1388 wrote to memory of 1048	1388	Quotation.exe	schtasks.exe
PID 1388 wrote to memory of 1048	1388	Quotation.exe	schtasks.exe
PID 1388 wrote to memory of 1328	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1328	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1328	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1328	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe
PID 1388 wrote to memory of 1840	1388	Quotation.exe	Quotation.exe

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\galygJm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF1E.tmp"
2⤵
- Creates scheduled task(s)
PID:1048

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"{path}"
2⤵
PID:1328

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEF1E.tmp

Download Submit
memory/1048-2-0x0000000000000000-mapping.dmp

Download
memory/1388-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1840-4-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1840-5-0x000000000044B6AE-mapping.dmp

Download
memory/1840-6-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1840-7-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads