Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    16/09/2023, 08:46

General

  • Target

    RFQ#110923-AQUA CHEMICALS .exe

  • Size

    616KB

  • MD5

    a1199ed6fcf3f1c71ec6f7985e5100e3

  • SHA1

    18b851e06738affda16d7e34d7692d1d7dbf3ba9

  • SHA256

    97cb55e3d35fc1c1d67b760d2e71ccd40f561bf06855e5ef06affac9ff4a5fd7

  • SHA512

    4da1a84ce1256131559b9ff88150ebc026377e765606c99deae39e2d3b2ec37f9ef214505ea621c930d81e87fdf6f5a66e968f99b9cb663d5702ef725398dd19

  • SSDEEP

    12288:Sgm/SMJhGty5uhp065Q9BcK1DttFe4ANiX0:Sg1gRR6SQK1DttFYik

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ#110923-AQUA CHEMICALS .exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ#110923-AQUA CHEMICALS .exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 560
      2⤵
      • Program crash
      PID:1572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsj675D.tmp\System.dll

    Filesize

    12KB

    MD5

    6e55a6e7c3fdbd244042eb15cb1ec739

    SHA1

    070ea80e2192abc42f358d47b276990b5fa285a9

    SHA256

    acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

    SHA512

    2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

  • C:\Users\Admin\AppData\Local\Temp\nsj675D.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsj675D.tmp\System.dll

    Filesize

    12KB

    MD5

    6e55a6e7c3fdbd244042eb15cb1ec739

    SHA1

    070ea80e2192abc42f358d47b276990b5fa285a9

    SHA256

    acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

    SHA512

    2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

  • \Users\Admin\AppData\Local\Temp\nsj675D.tmp\System.dll

    Filesize

    12KB

    MD5

    6e55a6e7c3fdbd244042eb15cb1ec739

    SHA1

    070ea80e2192abc42f358d47b276990b5fa285a9

    SHA256

    acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

    SHA512

    2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

  • \Users\Admin\AppData\Local\Temp\nsj675D.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsj675D.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsj675D.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsj675D.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsj675D.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsj675D.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1