ff4bcfd3663088b0e8fed48b19bf950f8a6680fea9d3b0a478ac1fbfbcefeeef

General

Target

RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe
Size

797KB
MD5

d9a372fd1f0401897210599c330124b6
SHA1

570eff9c5b310ef0a577804be2ab2dcf470a139f
SHA256

ff4bcfd3663088b0e8fed48b19bf950f8a6680fea9d3b0a478ac1fbfbcefeeef
SHA512

6df19c26284e5aa2951692ecdeb59ce7cb4861b181c468857be58c51344a2807450337ca1c8e3539422d44cb8939f169b7bf1b957aff0e7e7bf7995876a4a928

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1492 wrote to memory of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26
PID 1896 wrote to memory of 1136	1896	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	27
PID 1896 wrote to memory of 1136	1896	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	27
PID 1896 wrote to memory of 1136	1896	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	27
PID 1896 wrote to memory of 1136	1896	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	27
PID 1896 wrote to memory of 1136	1896	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	27
PID 1896 wrote to memory of 1136	1896	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	27

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1896	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1492	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1896	RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe

C:\Users\Admin\AppData\Local\Temp\RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe
"C:\Users\Admin\AppData\Local\Temp\RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1492
- C:\Users\Admin\AppData\Local\Temp\RFP_NDT_ServicesandEquipments_Proposal_Project_dwg.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetWindowsHookEx
  PID:1896
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-6-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1896-2-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1896-4-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing