aaa987ccb8c68c04bfcf7fc198004dec19b129786a0d945439220aea6c28b188

Analysis

max time kernel
26s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37369110a6f74f4e85e645346832f1a1.exe
Size 20KB
Sample231231-qbfrfshdf7
SHA256 aaa987ccb8c68c04bfcf7fc198004dec19b129786a0d945439220aea6c28b188
MD5 37369110a6f74f4e85e645346832f1a1
SHA1 4b8929aa24094d526b11e7c9c7efb4703699e112
SHA512 4995bec14b63ef01971630151babed26a62fc704e472d5e559c9499d866f167bccc4ced3a08f4c34701616ee651ecf4be8d88ff02d3a17bb1fdd359c32108c95
SSDEEP 384:pOUsmVL3GYR9BE3AE3m6E3DE30E3OE34E38E3BZqE3Yfh/1tvnl4P61frkRrDx4a:YUvV7eK11rhr4maz1lLH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5112	takqj.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\takqj.exe	37369110a6f74f4e85e645346832f1a1.exe
File opened for modification	C:\Windows\SysWOW64\takqj.exe	37369110a6f74f4e85e645346832f1a1.exe

Kills process with taskkill 17 IoCs

evasion

pid	Process
988	taskkill.exe
1268	taskkill.exe
4008	taskkill.exe
1924	taskkill.exe
3984	taskkill.exe
3620	taskkill.exe
1688	taskkill.exe
4496	taskkill.exe
4540	taskkill.exe
1944	taskkill.exe
2888	taskkill.exe
2096	taskkill.exe
1136	taskkill.exe
3968	taskkill.exe
3132	taskkill.exe
4812	taskkill.exe
3008	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2120	37369110a6f74f4e85e645346832f1a1.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2112	2120	37369110a6f74f4e85e645346832f1a1.exe	56
PID 2120 wrote to memory of 2112	2120	37369110a6f74f4e85e645346832f1a1.exe	56
PID 2120 wrote to memory of 2112	2120	37369110a6f74f4e85e645346832f1a1.exe	56
PID 2120 wrote to memory of 4264	2120	37369110a6f74f4e85e645346832f1a1.exe	55
PID 2120 wrote to memory of 4264	2120	37369110a6f74f4e85e645346832f1a1.exe	55
PID 2120 wrote to memory of 4264	2120	37369110a6f74f4e85e645346832f1a1.exe	55
PID 2120 wrote to memory of 5032	2120	37369110a6f74f4e85e645346832f1a1.exe	54
PID 2120 wrote to memory of 5032	2120	37369110a6f74f4e85e645346832f1a1.exe	54
PID 2120 wrote to memory of 5032	2120	37369110a6f74f4e85e645346832f1a1.exe	54
PID 2120 wrote to memory of 4908	2120	37369110a6f74f4e85e645346832f1a1.exe	53
PID 2120 wrote to memory of 4908	2120	37369110a6f74f4e85e645346832f1a1.exe	53
PID 2120 wrote to memory of 4908	2120	37369110a6f74f4e85e645346832f1a1.exe	53
PID 2120 wrote to memory of 2436	2120	37369110a6f74f4e85e645346832f1a1.exe	52
PID 2120 wrote to memory of 2436	2120	37369110a6f74f4e85e645346832f1a1.exe	52
PID 2120 wrote to memory of 2436	2120	37369110a6f74f4e85e645346832f1a1.exe	52
PID 5112 wrote to memory of 2412	5112	takqj.exe	46
PID 5112 wrote to memory of 2412	5112	takqj.exe	46
PID 5112 wrote to memory of 2412	5112	takqj.exe	46
PID 5112 wrote to memory of 3776	5112	takqj.exe	45
PID 5112 wrote to memory of 3776	5112	takqj.exe	45
PID 5112 wrote to memory of 3776	5112	takqj.exe	45
PID 5112 wrote to memory of 780	5112	takqj.exe	44
PID 5112 wrote to memory of 780	5112	takqj.exe	44
PID 5112 wrote to memory of 780	5112	takqj.exe	44
PID 5112 wrote to memory of 1688	5112	takqj.exe	43
PID 5112 wrote to memory of 1688	5112	takqj.exe	43
PID 5112 wrote to memory of 1688	5112	takqj.exe	43
PID 5112 wrote to memory of 2996	5112	takqj.exe	19
PID 5112 wrote to memory of 2996	5112	takqj.exe	19
PID 5112 wrote to memory of 2996	5112	takqj.exe	19
PID 2120 wrote to memory of 4460	2120	37369110a6f74f4e85e645346832f1a1.exe	42
PID 2120 wrote to memory of 4460	2120	37369110a6f74f4e85e645346832f1a1.exe	42
PID 2120 wrote to memory of 4460	2120	37369110a6f74f4e85e645346832f1a1.exe	42
PID 2112 wrote to memory of 3008	2112	cmd.exe	23
PID 2112 wrote to memory of 3008	2112	cmd.exe	23
PID 2112 wrote to memory of 3008	2112	cmd.exe	23
PID 4908 wrote to memory of 4812	4908	cmd.exe	133
PID 4908 wrote to memory of 4812	4908	cmd.exe	133
PID 4908 wrote to memory of 4812	4908	cmd.exe	133
PID 2436 wrote to memory of 4008	2436	Process not Found	38
PID 2436 wrote to memory of 4008	2436	Process not Found	38
PID 2436 wrote to memory of 4008	2436	Process not Found	38
PID 2996 wrote to memory of 1268	2996	cmd.exe	31
PID 2996 wrote to memory of 1268	2996	cmd.exe	31
PID 2996 wrote to memory of 1268	2996	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\37369110a6f74f4e85e645346832f1a1.exe
"C:\Users\Admin\AppData\Local\Temp\37369110a6f74f4e85e645346832f1a1.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\373691~1.EXE > nul
  2⤵
  PID:4460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwproxy.exe
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwstub.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwsrv.exe
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwmain.exe
  2⤵
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im rfwproxy.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im rfwproxy.exe
  2⤵
  - Kills process with taskkill
  PID:1268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwstub.exe
1⤵
- Kills process with taskkill
PID:4812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  PID:4540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:3008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwmain.exe
1⤵
- Kills process with taskkill
PID:3984

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwsrv.exe
1⤵
- Kills process with taskkill
PID:4496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwstub.exe
1⤵
- Kills process with taskkill
PID:3620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwmain.exe
1⤵
- Kills process with taskkill
PID:2888
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwsrv.exe
1⤵
- Kills process with taskkill
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:2096

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im 360tray.exe
1⤵
PID:2576

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwproxy.exe
1⤵
- Kills process with taskkill
PID:4008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im rfwstub.exe
1⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im rfwsrv.exe
1⤵
PID:780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im rfwmain.exe
1⤵
PID:3776

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im 360tray.exe
1⤵
PID:2412

C:\Windows\SysWOW64\takqj.exe
C:\Windows\SysWOW64\takqj.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:3972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im 360tray.exe
    3⤵
    - Kills process with taskkill
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:2888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:1136

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:3968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:3132

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads