e40fc6b716c7cefb0932e79b1924bdbae4045d9a62fbe2cc7ef89c8235966fbe

General

Target
RFQ.exe
Size 821KB
Sample201013-earjjc7cvn
SHA256 e40fc6b716c7cefb0932e79b1924bdbae4045d9a62fbe2cc7ef89c8235966fbe
MD5 5fde03f41ae673fd5fe71803245e7876
SHA1 e9d99a9dac85a4a42f6c784046cc5ccb826be120
SHA512 3257a8a9f8820a4150c7abf12929d8758d7cf7f0d23b7f1e7ae8e4c270f2f1f4d0f4be6077b01f4c0570424e5da20d3113e36a2d60709c59141dd32dc6a8b0e5
MD5 SHA1 SHA512

Score

9^/10

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RFQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RFQ.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\fecapp = "C:\\Users\\Admin\\AppData\\Roaming\\fecapp\\fecapp.exe"	RFQ.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RFQ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	RFQ.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 720 set thread context of 2464	720	RFQ.exe	79

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2464	RFQ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	720	RFQ.exe
Token: SeDebugPrivilege	2464	RFQ.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 1744	720	RFQ.exe	77
PID 720 wrote to memory of 1744	720	RFQ.exe	77
PID 720 wrote to memory of 1744	720	RFQ.exe	77
PID 720 wrote to memory of 2464	720	RFQ.exe	79
PID 720 wrote to memory of 2464	720	RFQ.exe	79
PID 720 wrote to memory of 2464	720	RFQ.exe	79
PID 720 wrote to memory of 2464	720	RFQ.exe	79
PID 720 wrote to memory of 2464	720	RFQ.exe	79
PID 720 wrote to memory of 2464	720	RFQ.exe	79
PID 720 wrote to memory of 2464	720	RFQ.exe	79
PID 720 wrote to memory of 2464	720	RFQ.exe	79

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ThoryzESPzFGGy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp83E6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\RFQ.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2464