c298da56eb8b11fd96859a1f9434d6c4e251f574e48a0cc2d066d442b9bf182e

Analysis

Target
QUOTE.exe
Size 628KB
Sample200818-7nffs2f2de
SHA256 c298da56eb8b11fd96859a1f9434d6c4e251f574e48a0cc2d066d442b9bf182e
MD5 a072e1ccc823870f51633d76551a6869
SHA1 a1c1498ec586004fa4fa51dfbda307dcb403d41e
SHA512 d3f70a93783f5dc9b591f0d03086aeb609ed30d57e34bbf2c924dd236f342fc985cf1cc43861b7310a30175e4334e3b28b1e528b6ff42059b884b5d4d4623d37
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	QUOTE.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 484	316	QUOTE.exe	24
PID 316 wrote to memory of 484	316	QUOTE.exe	24
PID 316 wrote to memory of 484	316	QUOTE.exe	24
PID 316 wrote to memory of 484	316	QUOTE.exe	24
PID 316 wrote to memory of 756	316	QUOTE.exe	25
PID 316 wrote to memory of 756	316	QUOTE.exe	25
PID 316 wrote to memory of 756	316	QUOTE.exe	25
PID 316 wrote to memory of 756	316	QUOTE.exe	25
PID 316 wrote to memory of 932	316	QUOTE.exe	26
PID 316 wrote to memory of 932	316	QUOTE.exe	26
PID 316 wrote to memory of 932	316	QUOTE.exe	26
PID 316 wrote to memory of 932	316	QUOTE.exe	26
PID 316 wrote to memory of 1092	316	QUOTE.exe	27
PID 316 wrote to memory of 1092	316	QUOTE.exe	27
PID 316 wrote to memory of 1092	316	QUOTE.exe	27
PID 316 wrote to memory of 1092	316	QUOTE.exe	27
PID 316 wrote to memory of 1080	316	QUOTE.exe	28
PID 316 wrote to memory of 1080	316	QUOTE.exe	28
PID 316 wrote to memory of 1080	316	QUOTE.exe	28
PID 316 wrote to memory of 1080	316	QUOTE.exe	28

C:\Users\Admin\AppData\Local\Temp\QUOTE.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Local\Temp\QUOTE.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"
  2⤵
  PID:484
- C:\Users\Admin\AppData\Local\Temp\QUOTE.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"
  2⤵
  PID:756
- C:\Users\Admin\AppData\Local\Temp\QUOTE.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\QUOTE.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"
  2⤵
  PID:1092
- C:\Users\Admin\AppData\Local\Temp\QUOTE.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"
  2⤵
  PID:1080

memory/316-0-0x0000000074B10000-0x00000000751FE000-memory.dmp

Download

memory/316-1-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/316-3-0x0000000000580000-0x0000000000583000-memory.dmp

Download

memory/316-4-0x0000000005100000-0x000000000517F000-memory.dmp

Download

memory/316-5-0x0000000005280000-0x00000000052D7000-memory.dmp

Download