Analysis
-
max time kernel
45s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 02:47
Static task
static1
Behavioral task
behavioral1
Sample
RE QUATATION 3456765.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RE QUATATION 3456765.exe
Resource
win10v2004-20220414-en
General
-
Target
RE QUATATION 3456765.exe
-
Size
844KB
-
MD5
94b5d1e0347081440bf95c6e1a5a26e8
-
SHA1
5e945849f712f7a565a1c75d1d2e58eeff39775d
-
SHA256
846f306ccd5e9d610aa3bb92817e08e123cc6be01c4771cdcad518130770c9dd
-
SHA512
04d85dd2a93b3c9894d2c7e861910e507fdab0147556854eaa74f329d40e448d525e2eec9d106204a8dec8d951457a469a38a2a4b61c9cc7a133d46639bafdef
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1064-56-0x0000000006630000-0x00000000066DE000-memory.dmp rezer0 -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
RE QUATATION 3456765.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RE QUATATION 3456765.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RE QUATATION 3456765.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
RE QUATATION 3456765.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 RE QUATATION 3456765.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum RE QUATATION 3456765.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
RE QUATATION 3456765.exepid process 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe 1064 RE QUATATION 3456765.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RE QUATATION 3456765.exedescription pid process Token: SeDebugPrivilege 1064 RE QUATATION 3456765.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
RE QUATATION 3456765.exedescription pid process target process PID 1064 wrote to memory of 1996 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1996 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1996 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1996 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1604 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1604 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1604 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1604 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1964 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1964 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1964 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1964 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1648 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1648 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1648 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1648 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1800 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1800 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1800 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe PID 1064 wrote to memory of 1800 1064 RE QUATATION 3456765.exe RE QUATATION 3456765.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe"C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe"{path}"2⤵