8ceceb731a2c09d552835ade18b92d47e10e24cb34cdb4954b1a97905fd10b29

Analysis

max time kernel
3s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2023, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Petronas requesting quotations.exe
Size 358KB
Sample230911-l83v2afb9w
SHA256 8ceceb731a2c09d552835ade18b92d47e10e24cb34cdb4954b1a97905fd10b29
MD5 e1b786b74762bec05c93625a67ca8d46
SHA1 95f70125a4cd1a019ef76eb02ebf20e7053175c3
SHA512 e5da921cfa6b4603acc79b649c665d45f95bdafe5255b9b14693af05c041ebaadcf56656abe0ccf977a12bcfac3b0d41d7ba7410f50da00ecd32b72707f035b2
SSDEEP 6144:vYa62rQUGPOl1GrvQ4+lwHkkhHvtZrpUuQg2hhpzdnIePcHs8Haj+e7BO:vYAPGPvol0kkhHlP/QgKhp1IePmal8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4836	qfwvhhlk.exe
1748	qfwvhhlk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4836 set thread context of 1748	4836	qfwvhhlk.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4836	qfwvhhlk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4836	2376	Petronas requesting quotations.exe	86
PID 2376 wrote to memory of 4836	2376	Petronas requesting quotations.exe	86
PID 2376 wrote to memory of 4836	2376	Petronas requesting quotations.exe	86
PID 4836 wrote to memory of 1748	4836	qfwvhhlk.exe	87
PID 4836 wrote to memory of 1748	4836	qfwvhhlk.exe	87
PID 4836 wrote to memory of 1748	4836	qfwvhhlk.exe	87
PID 4836 wrote to memory of 1748	4836	qfwvhhlk.exe	87

C:\Users\Admin\AppData\Local\Temp\Petronas requesting quotations.exe
"C:\Users\Admin\AppData\Local\Temp\Petronas requesting quotations.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\qfwvhhlk.exe
  "C:\Users\Admin\AppData\Local\Temp\qfwvhhlk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\qfwvhhlk.exe
    "C:\Users\Admin\AppData\Local\Temp\qfwvhhlk.exe"
    3⤵
    - Executes dropped EXE
    PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amtthj.pn

Path C:\Users\Admin\AppData\Local\Temp\amtthj.pn
Size 249KB
SHA256 a777a82ef1e869409a63f4db0fdd44495cb8e041052ab0fbdb2777c7091f621c
MD5 73a86375b82349213ef143ccdb01a40f
SHA1 5da5d64dbd5d1f73a38570880e01011be87eeec0
SHA512 f736e6a2458e1f5ff75818753328af065e76e98c7e5803a6bffc49580a2373774d33e66aea393829640a800abfb745425c6d52ea22089e304dcf9920e96046ab
SSDEEP 6144:oKloWY1fFHuekb1Ip8rtLC6P5FteD5kNVskmmf/o9V4:oQoPHd+g8hC6IisEn6V4
MD5 SHA1 SHA512 SSDEEP

Submit Download

qfwvhhlk.exe

Path C:\Users\Admin\AppData\Local\Temp\qfwvhhlk.exe
Size 158KB
SHA256 08dca1fe40ab2566e2e588989015c418c3fe59ff786a55b83bcf13ad27a3a3c7
MD5 6089207c6d5ac08e67fbfe9f8cdc3815
SHA1 6d44a8f2da197ae86454d6b1912d9951b200d423
SHA512 f9372952f95c5ecc6edc16a68f3b78ffe7b654f03072aa4064931d2d7aadb50dcab800721f7def76c5b088f168a8a50eabdf1c3c3b78056ffeda342409ffb03d
SSDEEP 1536:l93lzLhzWmCqK/DNbW4PesuPCWHC0InjuUBELs9OlXkH0JTFBMn+4INbhmm6Fxsy:TneNbMDIjusEg9K5FBMn+4I3mmzDXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

qfwvhhlk.exe

Path C:\Users\Admin\AppData\Local\Temp\qfwvhhlk.exe
Size 158KB
SHA256 08dca1fe40ab2566e2e588989015c418c3fe59ff786a55b83bcf13ad27a3a3c7
MD5 6089207c6d5ac08e67fbfe9f8cdc3815
SHA1 6d44a8f2da197ae86454d6b1912d9951b200d423
SHA512 f9372952f95c5ecc6edc16a68f3b78ffe7b654f03072aa4064931d2d7aadb50dcab800721f7def76c5b088f168a8a50eabdf1c3c3b78056ffeda342409ffb03d
SSDEEP 1536:l93lzLhzWmCqK/DNbW4PesuPCWHC0InjuUBELs9OlXkH0JTFBMn+4INbhmm6Fxsy:TneNbMDIjusEg9K5FBMn+4I3mmzDXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

qfwvhhlk.exe

Path C:\Users\Admin\AppData\Local\Temp\qfwvhhlk.exe
Size 158KB
SHA256 08dca1fe40ab2566e2e588989015c418c3fe59ff786a55b83bcf13ad27a3a3c7
MD5 6089207c6d5ac08e67fbfe9f8cdc3815
SHA1 6d44a8f2da197ae86454d6b1912d9951b200d423
SHA512 f9372952f95c5ecc6edc16a68f3b78ffe7b654f03072aa4064931d2d7aadb50dcab800721f7def76c5b088f168a8a50eabdf1c3c3b78056ffeda342409ffb03d
SSDEEP 1536:l93lzLhzWmCqK/DNbW4PesuPCWHC0InjuUBELs9OlXkH0JTFBMn+4INbhmm6Fxsy:TneNbMDIjusEg9K5FBMn+4I3mmzDXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1748-7-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/4836-5-0x00000000009C0000-0x00000000009C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads