Analysis
- max time kernel
140s - max time network
37s - platform
windows7_x64 - resource
win7v200430 - submitted
22/07/2020, 05:28
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_0084748572.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ_0084748572.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target RFQ_0084748572.exe
- Size 512KB
- Sample200722-c3xaef4ws2
- SHA256 c82a5ce771ee4c6afb7406184afba40c9aa6281c54cb9d6eeef5861d476cb3e9
- MD5 35c3b11abc85675f2c6ba3cdcfe6b8a0
- SHA1 775d9b7cedc8e5ebcbcc436ad05bf77545037455
- SHA512 3653c8e390ed0e5f931fa2d8051c0ab48fecd57cb6f05ddff7088d9d0fce2c8b62e76460fe835f1f3826cd9f9bf4b47c6a22dfebf73aaefc5b9f0951a722a45a
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 676 RFQ_0084748572.exe 676 RFQ_0084748572.exe 676 RFQ_0084748572.exe 676 RFQ_0084748572.exe 676 RFQ_0084748572.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 676 wrote to memory of 1716 676 RFQ_0084748572.exe 26 PID 676 wrote to memory of 1716 676 RFQ_0084748572.exe 26 PID 676 wrote to memory of 1716 676 RFQ_0084748572.exe 26 PID 676 wrote to memory of 1716 676 RFQ_0084748572.exe 26 PID 676 wrote to memory of 1856 676 RFQ_0084748572.exe 27 PID 676 wrote to memory of 1856 676 RFQ_0084748572.exe 27 PID 676 wrote to memory of 1856 676 RFQ_0084748572.exe 27 PID 676 wrote to memory of 1856 676 RFQ_0084748572.exe 27 PID 676 wrote to memory of 1848 676 RFQ_0084748572.exe 28 PID 676 wrote to memory of 1848 676 RFQ_0084748572.exe 28 PID 676 wrote to memory of 1848 676 RFQ_0084748572.exe 28 PID 676 wrote to memory of 1848 676 RFQ_0084748572.exe 28 PID 676 wrote to memory of 1864 676 RFQ_0084748572.exe 29 PID 676 wrote to memory of 1864 676 RFQ_0084748572.exe 29 PID 676 wrote to memory of 1864 676 RFQ_0084748572.exe 29 PID 676 wrote to memory of 1864 676 RFQ_0084748572.exe 29 PID 676 wrote to memory of 1880 676 RFQ_0084748572.exe 30 PID 676 wrote to memory of 1880 676 RFQ_0084748572.exe 30 PID 676 wrote to memory of 1880 676 RFQ_0084748572.exe 30 PID 676 wrote to memory of 1880 676 RFQ_0084748572.exe 30 - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 676 RFQ_0084748572.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_0084748572.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_0084748572.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:676 -
C:\Users\Admin\AppData\Local\Temp\RFQ_0084748572.exe"{path}"2⤵PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ_0084748572.exe"{path}"2⤵PID:1856
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ_0084748572.exe"{path}"2⤵PID:1848
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ_0084748572.exe"{path}"2⤵PID:1864
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ_0084748572.exe"{path}"2⤵PID:1880
-