Analysis
- max time kernel
148s - max time network
148s - platform
windows10_x64 - resource
win10 - submitted
13/10/2020, 14:46
General
- Target RFQ.exe
- Size 942KB
- Sample201013-yz7p2c6frx
- SHA256 3922c5b53b3f4d4b7cfd93c48d0f95d7f0de494d52b43019643403dcafccd80b
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 11602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1564-10-0x0000000004F50000-0x0000000004F51000-memory.dmp
memory/1564-11-0x0000000005710000-0x0000000005711000-memory.dmp
memory/3848-0-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/3848-1-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/3848-3-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
memory/3848-4-0x0000000005280000-0x0000000005281000-memory.dmp
memory/3848-5-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/3848-6-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/3848-7-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/3848-8-0x0000000005780000-0x0000000005F80000-memory.dmp
memory/3848-9-0x00000000064A0000-0x0000000006547000-memory.dmp