a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 01:18

Target

a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe
Size

289KB
MD5

6b174efad313abd4df83a766dcc23985
SHA1

e8149b99798ed214d522ad2225ce47e1ea3e81b4
SHA256

a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed
SHA512

88629ff0558658c9b5b6675ac45eab33180f16b09567fecc7073dd9f86eb4e428cf17418bf9740ee68f447ef8344c283948ed8999f9830911a3b151cdc705198
SSDEEP

3072:5A0EIRXX1P2UgAFxY3m5OZjSg9Z4hNeND55N4pLthECQT68VMJLaQljVvzUpz:5AzIdFuUgAFxm7SizNkECzJLaQVbU5

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2720	RKFQT.exe

Loads dropped DLL 2 IoCs

pid	Process
2260	cmd.exe
2260	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\RKFQT.exe	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe
File created	C:\windows\SysWOW64\RKFQT.exe.bat	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe
File created	C:\windows\SysWOW64\RKFQT.exe	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe
2720	RKFQT.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2368	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe
2368	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe
2720	RKFQT.exe
2720	RKFQT.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2260	2368	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe	28
PID 2368 wrote to memory of 2260	2368	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe	28
PID 2368 wrote to memory of 2260	2368	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe	28
PID 2368 wrote to memory of 2260	2368	a3451057977e34cb4163bc3a5ff2a24bfaeb21e06113e9952ebfe76e3ec3a6ed.exe	28
PID 2260 wrote to memory of 2720	2260	cmd.exe	30
PID 2260 wrote to memory of 2720	2260	cmd.exe	30
PID 2260 wrote to memory of 2720	2260	cmd.exe	30
PID 2260 wrote to memory of 2720	2260	cmd.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\RKFQT.exe.bat

Filesize
74B

MD5
d3117b64452ccc19217319b22ea0ee5f

SHA1
b473c4cec9c28c1f2b69f12107667884044c96e0

SHA256
e3723fad55ef2f39f39033bf241895b750311f1842214a6468414fd7cdd97006

SHA512
199af55b9b01dc8aed01d6a5d6bb12cf7f57b623acb2ccf2db163323a5b0d49472716713f08b784674e75d284bcf044d8475afb7e0cf7523e6369626c3315afa

Download Submit
\Windows\SysWOW64\RKFQT.exe

Filesize
289KB

MD5
4d3a26e83615de3871788b4ea23538df

SHA1
22d6384d918bc335fa9ac94875cb57d226e003dd

SHA256
5e93a1b6b64267e6563921d4d017fc67a27f4ca78e8f85e9084b87c5f44b4725

SHA512
de6447d9f6cdfca39f19e376304c8de044385693986962f03e50929eb75b4d00a24ebca6dc58af8b46a44be836cdb509540c4d12ed8f3bb7017bcc853bb7dd07

Download Submit
memory/2260-15-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2260-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2368-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2368-13-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2720-20-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2720-21-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download