Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:34
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_LM29.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ_LM29.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
RFQ_LM29.exe
-
Size
836KB
-
MD5
1307faf78a3b2cf812c7603072e07975
-
SHA1
07c5d4a08734c70bca57665570df00f8205f6b98
-
SHA256
58ab939bd2ec0d5d90a58a3be754b4a5a745fb0263b7f211f5f199bca4b4ba22
-
SHA512
33957e9795ae6de9baf137231147882b697c5e9affeec8c96676408c8bdc686fa4837f58aa652fee9323c50810dead0d6ee28c586aa048edcc611db2903e35d8
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
RFQ_LM29.exepid process 1564 RFQ_LM29.exe 1564 RFQ_LM29.exe 1564 RFQ_LM29.exe 1564 RFQ_LM29.exe 1564 RFQ_LM29.exe 1564 RFQ_LM29.exe 1564 RFQ_LM29.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RFQ_LM29.exedescription pid process Token: SeDebugPrivilege 1564 RFQ_LM29.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
RFQ_LM29.exedescription pid process target process PID 1564 wrote to memory of 2044 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 2044 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 2044 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 2044 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1112 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1112 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1112 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1112 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1204 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1204 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1204 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1204 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 820 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 820 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 820 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 820 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1756 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1756 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1756 1564 RFQ_LM29.exe RFQ_LM29.exe PID 1564 wrote to memory of 1756 1564 RFQ_LM29.exe RFQ_LM29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_LM29.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_LM29.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\RFQ_LM29.exe"{path}"2⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\RFQ_LM29.exe"{path}"2⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\RFQ_LM29.exe"{path}"2⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\RFQ_LM29.exe"{path}"2⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\RFQ_LM29.exe"{path}"2⤵PID:1756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1564-54-0x00000000003F0000-0x00000000004C8000-memory.dmpFilesize
864KB
-
memory/1564-55-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/1564-56-0x00000000041F0000-0x0000000004258000-memory.dmpFilesize
416KB
-
memory/1564-57-0x0000000000640000-0x000000000068C000-memory.dmpFilesize
304KB