b3706a5ace23149f5ed6327656b49fa37aacf8814569312ac807c580a1b662d0

General

Target

New Quotation.exe
Size

713KB
MD5

1ddfef07c40749d9e7f67cf63decfa25
SHA1

9d55a43a877b8084c6c247907b4b95aed445a52f
SHA256

b3706a5ace23149f5ed6327656b49fa37aacf8814569312ac807c580a1b662d0
SHA512

e9416976aaf7bd9dd5b0c51e667f1750a91ba76eff3f1e4aea24faca27c5185b840004f5fd09abb5dc66465e2e1efba19f339f45c09a21b733d083b142db72da

Score

7^/10

spyware

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

New Quotation.exeNew Quotation.exe

pid process

112 New Quotation.exe
1064 New Quotation.exe
1064 New Quotation.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

New Quotation.exe

description pid process target process

PID 112 set thread context of 1064 112 New Quotation.exe New Quotation.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
112	New Quotation.exe
1064	New Quotation.exe
1064	New Quotation.exe

description	pid	process	target process
PID 112 set thread context of 1064	112	New Quotation.exe	New Quotation.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

New Quotation.exe

description	pid	process	target process
PID 112 wrote to memory of 740	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 740	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 740	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 740	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe
PID 112 wrote to memory of 1064	112	New Quotation.exe	New Quotation.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

New Quotation.exeNew Quotation.exe

description pid process

Token: SeDebugPrivilege 112 New Quotation.exe
Token: SeDebugPrivilege 1064 New Quotation.exe

description	pid	process
Token: SeDebugPrivilege	112	New Quotation.exe
Token: SeDebugPrivilege	1064	New Quotation.exe

C:\Users\Admin\AppData\Local\Temp\New Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\New Quotation.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Users\Admin\AppData\Local\Temp\New Quotation.exe
"{path}"
2⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\New Quotation.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1064-1-0x0000000000446F5E-mapping.dmp

Download
memory/1064-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1064-3-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing