Analysis
-
max time kernel
75s -
max time network
45s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 18:29
Static task
static1
Behavioral task
behavioral1
Sample
SEND THE QUOTATI...exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
SEND THE QUOTATI...exe
Resource
win10
General
-
Target
SEND THE QUOTATI...exe
-
Size
714KB
-
MD5
3dc1e73c7d834e1141d1f84a2c15276c
-
SHA1
520140b17e6b09f2df2d173236be714957940b06
-
SHA256
0d0be22c9e96a4cd2a2fa90c77240c8cb74748b38ba9b5ee9891329326a21fcc
-
SHA512
264de35bacbf555e168383b2fa5bbce559ffaf9ea42138a5729f1dda20b46f94cb0b123d44b2dcfb9d94f1838407ccff3824dc201426be9033439f3f803550ed
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SEND THE QUOTATI...exedescription pid process target process PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe PID 888 wrote to memory of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SEND THE QUOTATI...exedescription pid process target process PID 888 set thread context of 1656 888 SEND THE QUOTATI...exe RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1656 RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1656 RegSvcs.exe 1656 RegSvcs.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\BAVLA = "C:\\Users\\Admin\\AppData\\Roaming\\BAVLA\\BAVLA.exe" RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SEND THE QUOTATI...exe"C:\Users\Admin\AppData\Local\Temp\SEND THE QUOTATI...exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-0-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1656-1-0x0000000000445DFE-mapping.dmp
-
memory/1656-2-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1656-3-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB