Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 13:54

General

  • Target

    RFQ-20240129.exe

  • Size

    906KB

  • MD5

    6d4443427f8685adac6eeb1448248f93

  • SHA1

    fa5bc1820f062cba30d413e67f61531abb96aa3d

  • SHA256

    706c041ad5d324064ea8bdcfb68f81e0fac4b6452d0629a30ce75d84592b1bd3

  • SHA512

    961b774b33bb9a6f003d1bcd8db80b5d0209ceaacfb1bfeec61719aedc988505d3ce535d9cc03ed7a6c6222a54de644b942e6567fde12196c9c3fb205d08f527

  • SSDEEP

    12288:JVfAoIFFHgeg/cSdBsV1In4qW6xzsU66kE3fldhU6MeS:JVfAXFxSu1In4F6xLHlfr263

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
      2⤵
        PID:2796
      • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
        "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
        2⤵
          PID:3040
        • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
          "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
          2⤵
            PID:2680
          • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
            "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
            2⤵
              PID:2216
            • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
              "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
              2⤵
                PID:2552

            Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1488-1-0x00000000749D0000-0x00000000750BE000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/1488-0-0x0000000000280000-0x0000000000368000-memory.dmp

                    Filesize

                    928KB

                  • memory/1488-2-0x0000000004D70000-0x0000000004DB0000-memory.dmp

                    Filesize

                    256KB

                  • memory/1488-3-0x0000000000440000-0x000000000045C000-memory.dmp

                    Filesize

                    112KB

                  • memory/1488-4-0x0000000000470000-0x0000000000484000-memory.dmp

                    Filesize

                    80KB

                  • memory/1488-5-0x0000000005310000-0x0000000005378000-memory.dmp

                    Filesize

                    416KB

                  • memory/1488-6-0x00000000749D0000-0x00000000750BE000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/1488-7-0x0000000004D70000-0x0000000004DB0000-memory.dmp

                    Filesize

                    256KB

                  • memory/1488-8-0x00000000749D0000-0x00000000750BE000-memory.dmp

                    Filesize

                    6.9MB