841ce7f81f9a7e7fb55e185c2cd20b3f535011e4bcd510efc3128027b19c77fd

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-06-2023 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION.exe
Size

293KB
MD5

b5157423e3f9544dccc36a58f0ab1511
SHA1

0fc888b6884c27577650b50bf52ea0f3a7e2727c
SHA256

841ce7f81f9a7e7fb55e185c2cd20b3f535011e4bcd510efc3128027b19c77fd
SHA512

5a8db8c93745248bd30b4ab2368141c18c206971bdbf6aead5cb5b8e28f43cdf0e92c606ce9c0c1095e33fb18e2f4f6817a9d342f0345db23c64460c1d869e68
SSDEEP

6144:5MrudbcDdc1vxEzYXF/Ayy9BanZXwiX514GsHEnrbd6+IMDPJw:5f/vx0iJAyy9snr5unEHdDDBw

Score

7^/10

discovery

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	QUOTATION.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	QUOTATION.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	QUOTATION.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1996	QUOTATION.exe
1268	QUOTATION.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 1268	1996	QUOTATION.exe	28

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Steel\Ouncene.Bit	QUOTATION.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Flberi\Medarbejderfonde\Solgel.Flo	QUOTATION.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1996	QUOTATION.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1268	1996	QUOTATION.exe	28
PID 1996 wrote to memory of 1268	1996	QUOTATION.exe	28
PID 1996 wrote to memory of 1268	1996	QUOTATION.exe	28
PID 1996 wrote to memory of 1268	1996	QUOTATION.exe	28
PID 1996 wrote to memory of 1268	1996	QUOTATION.exe	28

C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy1C7.tmp\System.dll

Filesize
12KB

MD5
6c38da8922cc37b4bbb77de4a63ad843

SHA1
4e0533fd11df8bddbd543ed58df7b6060d9f4631

SHA256
1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1

SHA512
ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430

Download Submit
memory/1268-66-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1268-67-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1268-68-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download