Analysis
-
max time kernel
105s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 14:11
Static task
static1
Behavioral task
behavioral1
Sample
RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe
Resource
win10v20201028
General
-
Target
RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe
-
Size
838KB
-
MD5
c27de4eb9217d995c1c5f139c96626b0
-
SHA1
4e235c872ae7717bc2d5c371a7ad5492bc7de56a
-
SHA256
4f9f34f2e3c9dc355556166b5cc06f20648e29800f9b93cb8512703d826c6972
-
SHA512
7dd20e125ce7180a4801994116d14a18b6534b8897eeb552bb5ec15b485a5e22395b7dafa0694548459a2e24c2d4709e6ac1bf1f667a0bcfdb39807a8f204f1b
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exedescription pid process target process PID 1944 set thread context of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exepid process 268 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe 268 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exedescription pid process Token: SeDebugPrivilege 268 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exedescription pid process target process PID 1944 wrote to memory of 1084 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe schtasks.exe PID 1944 wrote to memory of 1084 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe schtasks.exe PID 1944 wrote to memory of 1084 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe schtasks.exe PID 1944 wrote to memory of 1084 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe schtasks.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe PID 1944 wrote to memory of 268 1944 RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe"C:\Users\Admin\AppData\Local\Temp\RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ACFKzgfRy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp992.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe"C:\Users\Admin\AppData\Local\Temp\RFQ0128SR20KWT_DEUNGJU_FAKRU_AND_NAVEED.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp992.tmpMD5
4162d1d97db8f67aca8973f80a9844e0
SHA1e08b1f8532c6cab47040f5df678e0b83f1b10659
SHA256f31514f8fa36d4f090483ead07a931e0f65154f61efaad92782fdb44de398680
SHA51211f62beb6146a5ba519014d38ea89c49747df2335aceaf6547ec22004fbcbe24ab50fbd32ed7cdef658b4ed844d23e971cfac239c96188045bc598777927b6d1
-
memory/268-9-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/268-10-0x000000000043761E-mapping.dmp
-
memory/268-11-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/268-12-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/268-13-0x0000000074320000-0x0000000074A0E000-memory.dmpFilesize
6.9MB
-
memory/1084-7-0x0000000000000000-mapping.dmp
-
memory/1944-2-0x0000000074320000-0x0000000074A0E000-memory.dmpFilesize
6.9MB
-
memory/1944-3-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/1944-5-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/1944-6-0x0000000004A30000-0x0000000004AA5000-memory.dmpFilesize
468KB