Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 07:00
General
-
Target
Request For Quotation #67220GH1_pdf.scr
-
Size
1.2MB
-
MD5
5c570346aa5dc4eef3ef2fe334e5f528
-
SHA1
da7779e4e80b16f54482dbc40f26d44a9f40b20b
-
SHA256
0f0cac521eddc83b86542aaf28e05b0146a4643b3645b434b34f2ec30131b73d
-
SHA512
8fc0591f62473411dd1de687cda3c7e6663554b0101e3eb7553a3543de99a1d3577454b82b25635655cf2bb89613181f69d5bce640a69a86ace0d2dec6f995fa
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request For Quotation #67220GH1_pdf.scr"C:\Users\Admin\AppData\Local\Temp\Request For Quotation #67220GH1_pdf.scr" /S1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FSsBempFaLbg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp25F7.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp25F7.tmpMD5
1999a84ca7f9294c7e729e68c087d2c2
SHA1440958f5ae5fc779709e42b7f77767a5cb7158c2
SHA25618947b4a23049b6b9ea232c25a573e30e0a50eb581d7d38d7f41f0418e1e5a90
SHA512574304cfd09c274127f0d2c735ff0fa38e28f393c52790e62f01e36e167b9c40d96fd65b79cd47a075d26411eecf4fb106520db2f34240d09651bd46a3ac14a9
-
memory/1048-9-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/1048-5-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/1048-6-0x0000000005A20000-0x0000000005A21000-memory.dmpFilesize
4KB
-
memory/1048-7-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/1048-8-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/1048-2-0x0000000073BE0000-0x00000000742CE000-memory.dmpFilesize
6.9MB
-
memory/1048-10-0x0000000005420000-0x0000000005432000-memory.dmpFilesize
72KB
-
memory/1048-11-0x0000000006290000-0x0000000006305000-memory.dmpFilesize
468KB
-
memory/1048-3-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/1048-14-0x0000000006AA0000-0x0000000006AD7000-memory.dmpFilesize
220KB
-
memory/1048-15-0x0000000006C00000-0x0000000006C01000-memory.dmpFilesize
4KB
-
memory/1048-16-0x0000000006CA0000-0x0000000006CA1000-memory.dmpFilesize
4KB
-
memory/4092-12-0x0000000000000000-mapping.dmp