Analysis
- max time kernel
130s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/02/2021, 14:54
General
- Target REQUEST FOR QUOTE.exe
- Size 753KB
- Sample210217-lqmvhn29cs
- SHA256 6faef4e15fcae0545cbb7cdbb4200f4dcf7c18cdf12b072c65d779acef7d2092
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTE.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTE.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTE.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTE.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTE.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/616-7-0x0000000007910000-0x0000000007911000-memory.dmp
memory/616-3-0x0000000000A00000-0x0000000000A01000-memory.dmp
memory/616-6-0x0000000007E10000-0x0000000007E11000-memory.dmp
memory/616-2-0x0000000073160000-0x000000007384E000-memory.dmp
memory/616-8-0x0000000005420000-0x0000000005421000-memory.dmp
memory/616-9-0x0000000007AD0000-0x0000000007AD1000-memory.dmp
memory/616-5-0x0000000007870000-0x0000000007871000-memory.dmp
memory/616-10-0x0000000005450000-0x0000000005451000-memory.dmp
memory/616-12-0x0000000001200000-0x000000000126D000-memory.dmp
memory/616-11-0x00000000054D0000-0x00000000054D4000-memory.dmp
memory/3480-13-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3480-16-0x0000000073160000-0x000000007384E000-memory.dmp
memory/3480-21-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/3480-22-0x0000000005C00000-0x0000000005C01000-memory.dmp
memory/3480-23-0x00000000063D0000-0x00000000063D1000-memory.dmp