d8385c84de51c76e43b03a7dd97d50f8c8909deb823bde0b33c3e8db337718d7

Analysis

max time kernel
131s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTE_RE.exe
Size

537KB
MD5

49bb7f296f0a614f5dfce69519568a0c
SHA1

9aaa30e5a43187c74906c9b19bb02447f894e366
SHA256

b35ad0fe6a5d3df3158c26cda0089cded4b956857ea965877fe553bf7e2ac3b8
SHA512

a95dbeca11673ce19327bbce054c2957a9663c9b59010e2f70342db9770644b679c3c3d37b058d261c29491a3300d5dc26634196e104a766e5c5a99c286db9ac

Score

7^/10

collection spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

QUOTE_RE.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTE_RE.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTE_RE.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTE_RE.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

QUOTE_RE.exe

pid process

1620 QUOTE_RE.exe
1620 QUOTE_RE.exe
1620 QUOTE_RE.exe
1620 QUOTE_RE.exe
1620 QUOTE_RE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

QUOTE_RE.exe

description pid process

Token: SeDebugPrivilege 1620 QUOTE_RE.exe

pid	process
1620	QUOTE_RE.exe
1620	QUOTE_RE.exe
1620	QUOTE_RE.exe
1620	QUOTE_RE.exe
1620	QUOTE_RE.exe

description	pid	process
Token: SeDebugPrivilege	1620	QUOTE_RE.exe

outlook_office_path 1 IoCs

Processes:

QUOTE_RE.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTE_RE.exe

outlook_win_path 1 IoCs

Processes:

QUOTE_RE.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTE_RE.exe

C:\Users\Admin\AppData\Local\Temp\QUOTE_RE.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE_RE.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1620

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-130-0x00000000000B0000-0x000000000013C000-memory.dmp

Filesize
560KB

Download
memory/1620-131-0x0000000005070000-0x0000000005614000-memory.dmp

Filesize
5.6MB

Download
memory/1620-132-0x0000000004990000-0x0000000004A22000-memory.dmp

Filesize
584KB

Download
memory/1620-133-0x0000000004A80000-0x0000000004A8A000-memory.dmp

Filesize
40KB

Download
memory/1620-134-0x0000000008310000-0x00000000083AC000-memory.dmp

Filesize
624KB

Download
memory/1620-135-0x000000000F620000-0x000000000F686000-memory.dmp

Filesize
408KB

Download