Analysis
- max time kernel
146s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
20/06/2023, 06:28
General
- Target quotation request.exe
- Size 756KB
- Sample230620-g8clmabf2w
- SHA256 6f1acd309fb5ffdbfe2e1ca42dd060ed57e2107767f945f47cbbd71a5a189062
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\quotation request.exe"C:\Users\Admin\AppData\Local\Temp\quotation request.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\quotation request.exe"C:\Users\Admin\AppData\Local\Temp\quotation request.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1340-140-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1340-142-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1340-143-0x0000000000F00000-0x000000000124A000-memory.dmp
memory/1340-144-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4556-133-0x00000000008D0000-0x0000000000994000-memory.dmp
memory/4556-134-0x00000000058B0000-0x0000000005E54000-memory.dmp
memory/4556-135-0x00000000053A0000-0x0000000005432000-memory.dmp
memory/4556-136-0x0000000005530000-0x0000000005540000-memory.dmp
memory/4556-137-0x0000000005350000-0x000000000535A000-memory.dmp
memory/4556-138-0x0000000005530000-0x0000000005540000-memory.dmp
memory/4556-139-0x0000000007010000-0x00000000070AC000-memory.dmp