Overview

overview

10

Static

static

ReQUOTATIO...29.exe

windows7_x64

1

ReQUOTATIO...29.exe

windows10_x64

10

Analysis

  • max time kernel
    54s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    28-08-2020 06:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ReQUOTATION_REQUEST20200829.exe

  • Size

    712KB

  • MD5

    2114535592ff9c28d5bd897c10caada2

  • SHA1

    dd06260610bc0a4dbfcb0778cd4fdf703e10770e

  • SHA256

    30690dd57acb0fdd1b40b8985089381f463d9cc0601605782624283be72be025

  • SHA512

    c66835bd7c66a1c957f13257718dc36b8f94af8211995cf776b4dff97e1420bf2be926de64153e4ef6f6a96e8e05fe7d39611a6eb7d6c3b6f3b7f2cc8f3f7537

Score
1/10

Malware Config

Signatures

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
    "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grYggiKlrC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6BF.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1880
    • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
      "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
      2⤵
        PID:1952
      • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
        "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
        2⤵
          PID:1944
        • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
          "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
          2⤵
            PID:1924
          • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
            "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
            2⤵
              PID:1932
            • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
              "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
              2⤵
                PID:2000

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Defense Evasion

            Credential Access

            Discovery

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpD6BF.tmp
              MD5

              21de6bd913a59d2da6757b2ca3e6f108

              SHA1

              f227b456d89c2741160a65d956635b9e1277d5e1

              SHA256

              bad16a4ac4af64ae8fc53c137fec9a65a629500191082f5e42f8d872de36e724

              SHA512

              519d043f233225e7d0d586f683f6a50c1a4b8af6c231aa7e98e71e63d5fbfefeadfcbf66711ee1a809754c7351c9cc96e8dfccaf49ea6809561230394fe13054

              Download Submit
            • memory/1124-0-0x0000000073F10000-0x00000000745FE000-memory.dmp
              Filesize

              6.9MB

              Download
            • memory/1124-1-0x00000000002C0000-0x00000000002C1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1124-3-0x0000000001EE0000-0x0000000001EEB000-memory.dmp
              Filesize

              44KB

              Download
            • memory/1124-4-0x0000000005BD0000-0x0000000005C21000-memory.dmp
              Filesize

              324KB

              Download
            • memory/1124-5-0x0000000005D60000-0x0000000005D8E000-memory.dmp
              Filesize

              184KB

              Download
            • memory/1880-6-0x0000000000000000-mapping.dmp
              Download