bc93cd78bc4b52dc5c49a84f6e4992a3ce4cbb832e800f135e77d6ce0837e12d

General

Target

rQuotationRequestandProductAvailabilityForm.exe
Size

1.3MB
MD5

954a8d2d482bdbda7ef12631202d1fe7
SHA1

57411facad4016b2148f4c91e9b39f28f68aaa7f
SHA256

bc93cd78bc4b52dc5c49a84f6e4992a3ce4cbb832e800f135e77d6ce0837e12d
SHA512

7669e8e493b325ebd54cf6640c22fac1449ae0d7a0b4a3ffa1631c2079769545ccf6faebb0e4f81621d9c1fa21ab4987435329a192741a6e7263fd3b0f2ede9d
SSDEEP

24576:oAHnh+eWsN3skA4RV1Hom2KXMmHa01Q1kx+/Pzxbmq5:vh+ZkldoPK8Yad1kk1j

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1280 set thread context of 3052	1280	rQuotationRequestandProductAvailabilityForm.exe	28
PID 3052 set thread context of 1208	3052	svchost.exe	21
PID 3052 set thread context of 2452	3052	svchost.exe	29
PID 2452 set thread context of 1208	2452	nslookup.exe	21

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3052	svchost.exe
3052	svchost.exe
3052	svchost.exe
3052	svchost.exe
3052	svchost.exe
3052	svchost.exe
3052	svchost.exe
3052	svchost.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe
2452	nslookup.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1280	rQuotationRequestandProductAvailabilityForm.exe
3052	svchost.exe
1208	Explorer.EXE
1208	Explorer.EXE
2452	nslookup.exe
2452	nslookup.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1280	rQuotationRequestandProductAvailabilityForm.exe
1280	rQuotationRequestandProductAvailabilityForm.exe
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1280	rQuotationRequestandProductAvailabilityForm.exe
1280	rQuotationRequestandProductAvailabilityForm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3052	1280	rQuotationRequestandProductAvailabilityForm.exe	28
PID 1280 wrote to memory of 3052	1280	rQuotationRequestandProductAvailabilityForm.exe	28
PID 1280 wrote to memory of 3052	1280	rQuotationRequestandProductAvailabilityForm.exe	28
PID 1280 wrote to memory of 3052	1280	rQuotationRequestandProductAvailabilityForm.exe	28
PID 1280 wrote to memory of 3052	1280	rQuotationRequestandProductAvailabilityForm.exe	28
PID 1208 wrote to memory of 2452	1208	Explorer.EXE	29
PID 1208 wrote to memory of 2452	1208	Explorer.EXE	29
PID 1208 wrote to memory of 2452	1208	Explorer.EXE	29
PID 1208 wrote to memory of 2452	1208	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\rQuotationRequestandProductAvailabilityForm.exe
  "C:\Users\Admin\AppData\Local\Temp\rQuotationRequestandProductAvailabilityForm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\rQuotationRequestandProductAvailabilityForm.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3052
- C:\Windows\SysWOW64\nslookup.exe
  "C:\Windows\SysWOW64\nslookup.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ectosphere

Filesize
263KB

MD5
4dfa82ca215b028ec4883fccb9269b61

SHA1
9f9c7ec6424301ef888434640e4113a844090122

SHA256
a49cd98cfda95a85d8a1a627c93ed20198c55fcbf6fc3468ac0bb80cebd86b3f

SHA512
c45bb2dbe4eb851bf3543eb348d0b1e8d231070fef1723fd597e8b9360852266d941405146d3d9716c6260afa3ec0a21ba5130af032a83c4846398b54bf9c39c

Download Submit
memory/1208-16-0x00000000003B0000-0x00000000004B0000-memory.dmp

Filesize
1024KB

Download
memory/1280-11-0x0000000000260000-0x0000000000264000-memory.dmp

Filesize
16KB

Download
memory/2452-20-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2452-27-0x00000000003A0000-0x000000000043D000-memory.dmp

Filesize
628KB

Download
memory/2452-26-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2452-25-0x00000000003A0000-0x000000000043D000-memory.dmp

Filesize
628KB

Download
memory/2452-24-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2452-23-0x0000000002200000-0x0000000002503000-memory.dmp

Filesize
3.0MB

Download
memory/2452-19-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/3052-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-22-0x0000000000150000-0x000000000016E000-memory.dmp

Filesize
120KB

Download
memory/3052-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-18-0x0000000000150000-0x000000000016E000-memory.dmp

Filesize
120KB

Download
memory/3052-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-13-0x0000000000A30000-0x0000000000D33000-memory.dmp

Filesize
3.0MB

Download
memory/3052-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing