Analysis
-
max time kernel
18s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-08-2021 12:38
Static task
static1
Behavioral task
behavioral1
Sample
REQUEST FOR QUOTATION.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
REQUEST FOR QUOTATION.exe
Resource
win10v20210408
General
-
Target
REQUEST FOR QUOTATION.exe
-
Size
1.4MB
-
MD5
065f86911f83ae3ce15517458719cd38
-
SHA1
63f1c19bef78a88efa1139f8f6174caab6842174
-
SHA256
7252276a3d4ce0aaadb10b11422e4c4f625845c9c3359ffbaa63346b9fc65b4a
-
SHA512
b339223de8842297f29f838ceee752ca42693e6baf0994162fc059686e10c065eb16dae8e9687157d8a1e3600b0df40eb56412de532b2a220e6cf8184d87ef20
Malware Config
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4008-116-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor -
Suspicious use of SetThreadContext 1 IoCs
Processes:
REQUEST FOR QUOTATION.exedescription pid process target process PID 516 set thread context of 4008 516 REQUEST FOR QUOTATION.exe REQUEST FOR QUOTATION.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
REQUEST FOR QUOTATION.exepid process 516 REQUEST FOR QUOTATION.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
REQUEST FOR QUOTATION.exepid process 4008 REQUEST FOR QUOTATION.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
REQUEST FOR QUOTATION.exedescription pid process Token: SeShutdownPrivilege 4008 REQUEST FOR QUOTATION.exe Token: SeCreatePagefilePrivilege 4008 REQUEST FOR QUOTATION.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
REQUEST FOR QUOTATION.exeREQUEST FOR QUOTATION.exedescription pid process target process PID 516 wrote to memory of 4008 516 REQUEST FOR QUOTATION.exe REQUEST FOR QUOTATION.exe PID 516 wrote to memory of 4008 516 REQUEST FOR QUOTATION.exe REQUEST FOR QUOTATION.exe PID 516 wrote to memory of 4008 516 REQUEST FOR QUOTATION.exe REQUEST FOR QUOTATION.exe PID 516 wrote to memory of 4008 516 REQUEST FOR QUOTATION.exe REQUEST FOR QUOTATION.exe PID 4008 wrote to memory of 1292 4008 REQUEST FOR QUOTATION.exe cmd.exe PID 4008 wrote to memory of 1292 4008 REQUEST FOR QUOTATION.exe cmd.exe PID 4008 wrote to memory of 1292 4008 REQUEST FOR QUOTATION.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VteCN2csLehFmgLN.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VteCN2csLehFmgLN.batMD5
1964b28118733e9fd8650243bc4fff3e
SHA14badb74cc7156a9d1a02c58b22e70bcf69dada22
SHA256a842846200a9940a4df71678241024aa3529514999791ce5c6b079375056e9e9
SHA512e4172e321e629a62c33bc529187b3edd030154d573e0419d407de6f16322de8cb16773c10c87613c192711db8fe89d0f1d0c168588ed11096bb31006acd90482
-
memory/516-115-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1292-117-0x0000000000000000-mapping.dmp
-
memory/4008-114-0x000000000049D8CA-mapping.dmp
-
memory/4008-116-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB