Analysis
-
max time kernel
102s -
max time network
172s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 05:52
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-11015-12.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
RFQ-11015-12.exe
Resource
win10v2004-20220812-en
General
-
Target
RFQ-11015-12.exe
-
Size
27KB
-
MD5
a1dc1cff823fcdd66b73eef2e7c32715
-
SHA1
451cd2d2033b8774dab60a954e158c7aafaf2d47
-
SHA256
6200e8758a22991d5ac0af555cbe25f8d2b59ca0f5f212402d8ec805c7f5cfe7
-
SHA512
e105618d9863401f9ee56b7eb6ff826bb5b4bef76cef0b5b6b211c839b8ff7ed9277381c243f5e2855609c42c6ae1f74082c962398e5ebd2ed81a326d44e3623
-
SSDEEP
384:Nukgi2WJFHHMleT2gL1CAOh05PjoaYLR/NLXFqgnZE3eCjRyY+vGyox8u5/DpW+v:shKMM2jOj+RVLp4Vh+eyM8upJ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
RFQ-11015-12.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Bijyy\\Agpfya.exe\"," RFQ-11015-12.exe -
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4888-303-0x000000000042027E-mapping.dmp family_snakekeylogger behavioral1/memory/4888-337-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ-11015-12.exedescription pid process target process PID 4872 set thread context of 4888 4872 RFQ-11015-12.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeRFQ-11015-12.exeMSBuild.exepid process 4896 powershell.exe 4896 powershell.exe 4896 powershell.exe 4872 RFQ-11015-12.exe 4872 RFQ-11015-12.exe 4888 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ-11015-12.exepowershell.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 4872 RFQ-11015-12.exe Token: SeDebugPrivilege 4896 powershell.exe Token: SeDebugPrivilege 4888 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
RFQ-11015-12.exedescription pid process target process PID 4872 wrote to memory of 4896 4872 RFQ-11015-12.exe powershell.exe PID 4872 wrote to memory of 4896 4872 RFQ-11015-12.exe powershell.exe PID 4872 wrote to memory of 4896 4872 RFQ-11015-12.exe powershell.exe PID 4872 wrote to memory of 4880 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4880 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4880 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4888 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4888 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4888 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4888 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4888 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4888 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4888 4872 RFQ-11015-12.exe MSBuild.exe PID 4872 wrote to memory of 4888 4872 RFQ-11015-12.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-11015-12.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-11015-12.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4872-116-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-117-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-118-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-119-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-120-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-121-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-122-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-123-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-124-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-125-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-126-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-127-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-128-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-129-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-130-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-131-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-132-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-133-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-134-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-135-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-136-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-137-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-138-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-139-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-140-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-141-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-142-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-143-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-144-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-145-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-146-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-147-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-148-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-149-0x00000000000D0000-0x00000000000DC000-memory.dmpFilesize
48KB
-
memory/4872-150-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-151-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-152-0x0000000004E80000-0x000000000537E000-memory.dmpFilesize
5.0MB
-
memory/4872-153-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-154-0x0000000004A80000-0x0000000004B12000-memory.dmpFilesize
584KB
-
memory/4872-155-0x0000000004BC0000-0x0000000004C5C000-memory.dmpFilesize
624KB
-
memory/4872-156-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-157-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-158-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-159-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-160-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-161-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-162-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-163-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-164-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-165-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-166-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-167-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-168-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-169-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-170-0x0000000004E60000-0x0000000004E6A000-memory.dmpFilesize
40KB
-
memory/4872-171-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-172-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-173-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-174-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-175-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-176-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-177-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-178-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-179-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-180-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-181-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-182-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-183-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-184-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4872-200-0x0000000005CB0000-0x0000000005D64000-memory.dmpFilesize
720KB
-
memory/4872-201-0x0000000005F10000-0x0000000005FA2000-memory.dmpFilesize
584KB
-
memory/4872-202-0x0000000005FF0000-0x0000000006012000-memory.dmpFilesize
136KB
-
memory/4872-204-0x0000000006020000-0x0000000006370000-memory.dmpFilesize
3.3MB
-
memory/4888-303-0x000000000042027E-mapping.dmp
-
memory/4888-337-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4888-372-0x00000000065D0000-0x0000000006792000-memory.dmpFilesize
1.8MB
-
memory/4896-215-0x0000000000000000-mapping.dmp
-
memory/4896-251-0x00000000044E0000-0x0000000004516000-memory.dmpFilesize
216KB
-
memory/4896-256-0x0000000006BE0000-0x0000000007208000-memory.dmpFilesize
6.2MB
-
memory/4896-275-0x00000000072B0000-0x0000000007316000-memory.dmpFilesize
408KB
-
memory/4896-276-0x00000000074A0000-0x0000000007506000-memory.dmpFilesize
408KB
-
memory/4896-279-0x0000000007470000-0x000000000748C000-memory.dmpFilesize
112KB
-
memory/4896-280-0x0000000007CA0000-0x0000000007CEB000-memory.dmpFilesize
300KB
-
memory/4896-284-0x0000000007DA0000-0x0000000007E16000-memory.dmpFilesize
472KB
-
memory/4896-295-0x00000000092F0000-0x0000000009968000-memory.dmpFilesize
6.5MB
-
memory/4896-296-0x0000000008AA0000-0x0000000008ABA000-memory.dmpFilesize
104KB