Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
10-07-2020 07:33
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-Felype Castro from Brazil.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
RFQ-Felype Castro from Brazil.exe
Resource
win10
General
-
Target
RFQ-Felype Castro from Brazil.exe
-
Size
505KB
-
MD5
63aa1a0f5b295d759ec4b2a0823bdb8d
-
SHA1
f29ead5094b0354aad5e70f52e1a800cc5c8fb31
-
SHA256
91f4fdc2687907e6f6ff98c2302371175ba51abe8776c7f33e61a33e08b097a3
-
SHA512
2ea2c570d707f6699a806b4cf8283503192b899d2ef8f065cf532b56b3d3753c3a7c201b00987b94bda68fd2525e8cbfbadf10bf81b72798ad5ae97cb9fc68be
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ-Felype Castro from Brazil.exeRFQ-Felype Castro from Brazil.exeipconfig.exedescription pid process target process PID 1296 set thread context of 1228 1296 RFQ-Felype Castro from Brazil.exe RFQ-Felype Castro from Brazil.exe PID 1228 set thread context of 1304 1228 RFQ-Felype Castro from Brazil.exe Explorer.EXE PID 1740 set thread context of 1304 1740 ipconfig.exe Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RFQ-Felype Castro from Brazil.exeipconfig.exepid process 1228 RFQ-Felype Castro from Brazil.exe 1228 RFQ-Felype Castro from Brazil.exe 1228 RFQ-Felype Castro from Brazil.exe 1740 ipconfig.exe 1740 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
ipconfig.exedescription ioc process File opened for modification C:\Program Files (x86)\Mulz\ThumbCache_bc00fwh.exe ipconfig.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ-Felype Castro from Brazil.exeExplorer.EXEipconfig.exedescription pid process target process PID 1296 wrote to memory of 1228 1296 RFQ-Felype Castro from Brazil.exe RFQ-Felype Castro from Brazil.exe PID 1296 wrote to memory of 1228 1296 RFQ-Felype Castro from Brazil.exe RFQ-Felype Castro from Brazil.exe PID 1296 wrote to memory of 1228 1296 RFQ-Felype Castro from Brazil.exe RFQ-Felype Castro from Brazil.exe PID 1296 wrote to memory of 1228 1296 RFQ-Felype Castro from Brazil.exe RFQ-Felype Castro from Brazil.exe PID 1296 wrote to memory of 1228 1296 RFQ-Felype Castro from Brazil.exe RFQ-Felype Castro from Brazil.exe PID 1296 wrote to memory of 1228 1296 RFQ-Felype Castro from Brazil.exe RFQ-Felype Castro from Brazil.exe PID 1296 wrote to memory of 1228 1296 RFQ-Felype Castro from Brazil.exe RFQ-Felype Castro from Brazil.exe PID 1304 wrote to memory of 1740 1304 Explorer.EXE ipconfig.exe PID 1304 wrote to memory of 1740 1304 Explorer.EXE ipconfig.exe PID 1304 wrote to memory of 1740 1304 Explorer.EXE ipconfig.exe PID 1304 wrote to memory of 1740 1304 Explorer.EXE ipconfig.exe PID 1740 wrote to memory of 1792 1740 ipconfig.exe cmd.exe PID 1740 wrote to memory of 1792 1740 ipconfig.exe cmd.exe PID 1740 wrote to memory of 1792 1740 ipconfig.exe cmd.exe PID 1740 wrote to memory of 1792 1740 ipconfig.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
RFQ-Felype Castro from Brazil.exeipconfig.exepid process 1228 RFQ-Felype Castro from Brazil.exe 1228 RFQ-Felype Castro from Brazil.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe 1740 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ-Felype Castro from Brazil.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1228 RFQ-Felype Castro from Brazil.exe Token: SeDebugPrivilege 1740 ipconfig.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1792 cmd.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
ipconfig.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ipconfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LTXD9TK0WF5 = "C:\\Program Files (x86)\\Mulz\\ThumbCache_bc00fwh.exe" ipconfig.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\RFQ-Felype Castro from Brazil.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-Felype Castro from Brazil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\RFQ-Felype Castro from Brazil.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
PID:1740 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ-Felype Castro from Brazil.exe"3⤵
- Deletes itself
PID:1792