Analysis
-
max time kernel
131s -
max time network
27s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 11:19
General
-
Target
urgent RFQ.exe
-
Size
947KB
-
MD5
d7c96a638ddd3e123acef5e714e72c9b
-
SHA1
4e0279affabf56d08f0a50d75659c92ac9585280
-
SHA256
3d5aeffd916cfcb16b015b3c74992fe47870be047c7bbb82204204a3a22e2b1f
-
SHA512
f39a5ba23d888514376283089ed9775bca0e05ac4212abb6a7cd02d219e3bffa4c173d4ae437336adf755fd9d667066881a3cce8351b5f74e28890d0b857b598
Score
8/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\urgent RFQ.exe"C:\Users\Admin\AppData\Local\Temp\urgent RFQ.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\urgent RFQ.exe"C:\Users\Admin\AppData\Local\Temp\urgent RFQ.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
692KB
-
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
320KB
-
Filesize
300KB