Analysis
- max time kernel
142s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2023, 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RFQ for Req 12465.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
RFQ for Req 12465.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target RFQ for Req 12465.exe
- Size 292KB
- Sample230601-gr18nach45
- SHA256 bf6837cd64c8a37fc41b2d868fdd148e637f926e6665fe25f40f2b46327cdf31
- MD5 d22375a02236939df6e4f2b423322465
- SHA1 943e28a8cac663dc4beba7b9d298fb7268e1dcfa
- SHA512 c3c5fe2380dbb97a128935c1b607874ba51ee2aa4c5cac076157f84555e4f71e800b349f5149c9f41d06bf3c0b380038838ed43da05ff0805940b13ad6a5f671
- SSDEEP 6144:pYa6myvpo9HV+vftlItkuk66Km4VC7PP3ZovVb0f3FeuZrC3y21:pY4rMbIyLSmb7PPpovVb0fZZN21
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation RFQ for Req 12465.exe - Loads dropped DLL 1 IoCs
pid Process 1216 RFQ for Req 12465.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1216 set thread context of 3012 1216 RFQ for Req 12465.exe 84 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe 3012 RFQ for Req 12465.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1216 RFQ for Req 12465.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3012 RFQ for Req 12465.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1216 wrote to memory of 3012 1216 RFQ for Req 12465.exe 84 PID 1216 wrote to memory of 3012 1216 RFQ for Req 12465.exe 84 PID 1216 wrote to memory of 3012 1216 RFQ for Req 12465.exe 84 PID 1216 wrote to memory of 3012 1216 RFQ for Req 12465.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ for Req 12465.exe"C:\Users\Admin\AppData\Local\Temp\RFQ for Req 12465.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\RFQ for Req 12465.exe"C:\Users\Admin\AppData\Local\Temp\RFQ for Req 12465.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nso77A8.tmp\guwftqnj.dll
- Size 87KB
- SHA256 6f0d98d3dc49eff86371bd109407b3d4cb7fd5cfb5c3a5dd00733e2d74dadc01
- MD5 f08f78a2c44ba3bc855f773c8c68d93f
- SHA1 e7f5cc83fa9a22ce98d5a1f25f2cbea86c3f7086
- SHA512 ad930616ee30f0b05fe970116387eecb812918a9044c50b33a61bc89302e4dac4339dc484baa97d7a279b339961ee1e0621232bb19e6703baa1723bdbe999b45
- SSDEEP 1536:lP18UpDeqkd0U9sFksaSSLOE+pJDGSHOqsW7/cd+rP1WKyO2DSlt:lP1EjB9spSLHYg+rP1Wk2DAt
- MD5 SHA1 SHA512 SSDEEP