Analysis
- max time kernel
58s - max time network
116s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/08/2021, 05:28
General
- Target QUOTE 04202021.exe
- Size 1.2MB
- Sample210802-dnj8kkhnka
- SHA256 fdd736e40a5a51e56c45b86aa2f8ce729c6afea4cd9f8528427f7398e0663ae5
Malware Config
Signatures
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTE 04202021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE 04202021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/568-114-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/568-116-0x0000000005720000-0x0000000005721000-memory.dmp
memory/568-117-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/568-118-0x0000000002BF0000-0x0000000002C82000-memory.dmp
memory/568-119-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/568-120-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/568-121-0x0000000001270000-0x000000000127D000-memory.dmp
memory/568-122-0x000000000B300000-0x000000000B38C000-memory.dmp
memory/568-123-0x000000000C4D0000-0x000000000C4F2000-memory.dmp
memory/1252-124-0x0000000000400000-0x0000000000426000-memory.dmp
memory/1252-130-0x0000000004F60000-0x000000000545E000-memory.dmp