a1422a68552a1a97bdc63ca454352d1fd780056b38582e7f82bf12f6fc23593e

Analysis

max time kernel
145s
max time network
122s
platform
windows10_x64
resource
win10
submitted
19/10/2020, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ.exe
Size 764KB
Sample201019-cn7mzmlk7a
SHA256 a1422a68552a1a97bdc63ca454352d1fd780056b38582e7f82bf12f6fc23593e
MD5 86584708277a7d2347424d14fd83f2b8
SHA1 03755f9b2b70493b0a17b393e6d128497f6f0420
SHA512 0851009031439c4975bb9a54b4ec5e9ace0061dd58308a504b2d6e5988b9ce64975f9e0666da5e61c5a73fbc713ab75e5d73fbcba129c1730e0d18ba41bd7ded
MD5 SHA1 SHA512

Score

7^/10

spyware

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4060 set thread context of 1504	4060	RFQ.exe	76

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1504	RFQ.exe
1504	RFQ.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	RFQ.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1504	4060	RFQ.exe	76
PID 4060 wrote to memory of 1504	4060	RFQ.exe	76
PID 4060 wrote to memory of 1504	4060	RFQ.exe	76
PID 4060 wrote to memory of 1504	4060	RFQ.exe	76
PID 4060 wrote to memory of 1504	4060	RFQ.exe	76
PID 4060 wrote to memory of 1504	4060	RFQ.exe	76
PID 4060 wrote to memory of 1504	4060	RFQ.exe	76
PID 4060 wrote to memory of 1504	4060	RFQ.exe	76

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\RFQ.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1504-20-0x0000000005F30000-0x0000000005F31000-memory.dmp

Download

memory/1504-19-0x0000000005E90000-0x0000000005E91000-memory.dmp

Download

memory/1504-14-0x0000000073710000-0x0000000073DFE000-memory.dmp

Download

memory/4060-5-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download

memory/4060-8-0x0000000004BB0000-0x0000000004BBB000-memory.dmp

Download

memory/4060-9-0x0000000005970000-0x00000000059DD000-memory.dmp

Download

memory/4060-10-0x00000000059E0000-0x0000000005A18000-memory.dmp

Download

memory/4060-7-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/4060-6-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download

memory/4060-0-0x0000000073710000-0x0000000073DFE000-memory.dmp

Download

memory/4060-4-0x0000000005080000-0x0000000005081000-memory.dmp

Download

memory/4060-3-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/4060-1-0x0000000000200000-0x0000000000201000-memory.dmp

Download