Analysis
- max time kernel
118s - max time network
125s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
- submitted
09/08/2023, 17:42
General
- Target 2023-08-10 to update QCC RFQ no. 23002547.exe
- Size 860KB
- Sample230809-v9179sff6x
- SHA256 0432b62b226056b540dea3ec016a862521c3191da87f99ad5a02a1f633f9b947
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-10 to update QCC RFQ no. 23002547.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-10 to update QCC RFQ no. 23002547.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2023-08-10 to update QCC RFQ no. 23002547.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-10 to update QCC RFQ no. 23002547.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1384-71-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1384-73-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1384-79-0x0000000004800000-0x0000000004840000-memory.dmp
memory/1384-78-0x0000000074430000-0x0000000074B1E000-memory.dmp
memory/1384-75-0x0000000004800000-0x0000000004840000-memory.dmp
memory/1384-74-0x0000000074430000-0x0000000074B1E000-memory.dmp
memory/1384-64-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1384-69-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1384-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1384-66-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1384-63-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1384-65-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1964-56-0x0000000004DD0000-0x0000000004E10000-memory.dmp
memory/1964-62-0x0000000005DB0000-0x0000000005E2C000-memory.dmp
memory/1964-61-0x0000000004DD0000-0x0000000004E10000-memory.dmp
memory/1964-57-0x00000000005B0000-0x00000000005CC000-memory.dmp
memory/1964-60-0x0000000000630000-0x000000000063E000-memory.dmp
memory/1964-59-0x0000000004DD0000-0x0000000004E10000-memory.dmp
memory/1964-58-0x0000000074430000-0x0000000074B1E000-memory.dmp
memory/1964-76-0x0000000074430000-0x0000000074B1E000-memory.dmp
memory/1964-54-0x0000000000C00000-0x0000000000CDE000-memory.dmp
memory/1964-55-0x0000000074430000-0x0000000074B1E000-memory.dmp