07e783f93cb4f77e53bf07300e46e2fd096641d609d23f13b6903c87ff20dd66

General

Target

Urgent Quotation Notification_PDF/6N0eSKFgiTb66IA.exe
Size

656KB
MD5

dbc854edb4f43fcf32712a328f80e83c
SHA1

b1be36b4c9a08f488dd6ac224ba5d83262d8d8ad
SHA256

30ad47744445964405bb651788caf7f7b7d7ad8e9c7d06a9dd7057af586343a3
SHA512

fd45d95a0bb1ebab2f0defb892f679334d8524e5b6f0be6906dc9b6b5bd4274e6dc3ce860e32657ba7ec6dead4554f94ff17c75e7d5e89fbf3cf3907356b3a08
SSDEEP

12288:fqiGcJ+ruYgzGVqHW3x9imV88TsKVjddB8neTul+GGaT4XyC2j2apwJwtN:fqi8AaMYvVvTpVjKCVa0CCG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 2096	2008	6N0eSKFgiTb66IA.exe	29
PID 2096 set thread context of 1196	2096	6N0eSKFgiTb66IA.exe	21
PID 2096 set thread context of 1128	2096	6N0eSKFgiTb66IA.exe	32
PID 1128 set thread context of 1196	1128	chkntfs.exe	21

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkntfs.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2008	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe
1128	chkntfs.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2096	6N0eSKFgiTb66IA.exe
2096	6N0eSKFgiTb66IA.exe
1128	chkntfs.exe
1128	chkntfs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	6N0eSKFgiTb66IA.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2400	2008	6N0eSKFgiTb66IA.exe	28
PID 2008 wrote to memory of 2400	2008	6N0eSKFgiTb66IA.exe	28
PID 2008 wrote to memory of 2400	2008	6N0eSKFgiTb66IA.exe	28
PID 2008 wrote to memory of 2400	2008	6N0eSKFgiTb66IA.exe	28
PID 2008 wrote to memory of 2096	2008	6N0eSKFgiTb66IA.exe	29
PID 2008 wrote to memory of 2096	2008	6N0eSKFgiTb66IA.exe	29
PID 2008 wrote to memory of 2096	2008	6N0eSKFgiTb66IA.exe	29
PID 2008 wrote to memory of 2096	2008	6N0eSKFgiTb66IA.exe	29
PID 2008 wrote to memory of 2096	2008	6N0eSKFgiTb66IA.exe	29
PID 2008 wrote to memory of 2096	2008	6N0eSKFgiTb66IA.exe	29
PID 2008 wrote to memory of 2096	2008	6N0eSKFgiTb66IA.exe	29
PID 2096 wrote to memory of 1128	2096	6N0eSKFgiTb66IA.exe	32
PID 2096 wrote to memory of 1128	2096	6N0eSKFgiTb66IA.exe	32
PID 2096 wrote to memory of 1128	2096	6N0eSKFgiTb66IA.exe	32
PID 2096 wrote to memory of 1128	2096	6N0eSKFgiTb66IA.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\Urgent Quotation Notification_PDF\6N0eSKFgiTb66IA.exe
  "C:\Users\Admin\AppData\Local\Temp\Urgent Quotation Notification_PDF\6N0eSKFgiTb66IA.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\Urgent Quotation Notification_PDF\6N0eSKFgiTb66IA.exe
    "C:\Users\Admin\AppData\Local\Temp\Urgent Quotation Notification_PDF\6N0eSKFgiTb66IA.exe"
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Urgent Quotation Notification_PDF\6N0eSKFgiTb66IA.exe
    "C:\Users\Admin\AppData\Local\Temp\Urgent Quotation Notification_PDF\6N0eSKFgiTb66IA.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\SysWOW64\chkntfs.exe
      "C:\Windows\SysWOW64\chkntfs.exe"
      4⤵
      Suspicious use of SetThreadContext
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-28-0x0000000002860000-0x0000000002904000-memory.dmp

Filesize
656KB

Download
memory/1128-21-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/1128-22-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/1128-25-0x00000000024A0000-0x00000000027A3000-memory.dmp

Filesize
3.0MB

Download
memory/1128-26-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/1128-29-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/1196-20-0x0000000008DF0000-0x0000000009D79000-memory.dmp

Filesize
15.5MB

Download
memory/1196-19-0x0000000003110000-0x0000000003210000-memory.dmp

Filesize
1024KB

Download
memory/2008-3-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2008-0-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/2008-13-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2008-5-0x0000000001020000-0x00000000010AA000-memory.dmp

Filesize
552KB

Download
memory/2008-4-0x0000000000680000-0x000000000068C000-memory.dmp

Filesize
48KB

Download
memory/2008-2-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2008-1-0x00000000011F0000-0x000000000129A000-memory.dmp

Filesize
680KB

Download
memory/2096-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-18-0x00000000001D0000-0x00000000001F5000-memory.dmp

Filesize
148KB

Download
memory/2096-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-24-0x00000000001D0000-0x00000000001F5000-memory.dmp

Filesize
148KB

Download
memory/2096-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-14-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download
memory/2096-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing