8e7173102d77a6ed527fc3e783be4aa446e757f4417d3fa1f60f3e9cd0cff4f9

Analysis

Target
AGOCO RFQ NO 105017.exe
Size 482KB
Sample220120-m7ebqahfe6
SHA256 8e7173102d77a6ed527fc3e783be4aa446e757f4417d3fa1f60f3e9cd0cff4f9
MD5 76661f98b6bd857c7a5aed76da3552ad
SHA1 176b8966941a04bf833a19965eb3b8b0a9a9f3f8
SHA512 93a4c720727f4ee9de433bf0fe683fce76c45bc19617bd45d6db4f9aca5bf091a346243e51d4374cae0cb7d49f78d3036d185037c645d3bea5b55d40fcf12132
MD5 SHA1 SHA512

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2628	AGOCO RFQ NO 105017.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 2044	2628	AGOCO RFQ NO 105017.exe	60

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2044	2628	AGOCO RFQ NO 105017.exe	60
PID 2628 wrote to memory of 2044	2628	AGOCO RFQ NO 105017.exe	60
PID 2628 wrote to memory of 2044	2628	AGOCO RFQ NO 105017.exe	60
PID 2628 wrote to memory of 2044	2628	AGOCO RFQ NO 105017.exe	60
PID 2628 wrote to memory of 2044	2628	AGOCO RFQ NO 105017.exe	60
PID 2628 wrote to memory of 2044	2628	AGOCO RFQ NO 105017.exe	60

C:\Users\Admin\AppData\Local\Temp\AGOCO RFQ NO 105017.exe
"C:\Users\Admin\AppData\Local\Temp\AGOCO RFQ NO 105017.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\AGOCO RFQ NO 105017.exe
  "C:\Users\Admin\AppData\Local\Temp\AGOCO RFQ NO 105017.exe"
  2⤵
  PID:2044

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact