c2f6a681cc182ba57eb4672d9c6c0771b359f668262cf6da690f9109cdc280e9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ.NO_8877376398273.exe
Size 1.5MB
Sample240904-rjd39sshqe
SHA256 c2f6a681cc182ba57eb4672d9c6c0771b359f668262cf6da690f9109cdc280e9
MD5 409d87f299bde29844536be9961df1a6
SHA1 e4cbba870473097af7856d44e609b1b38f1d2ecc
SHA512 576c583abbae4df89ee06ce539f737305f99ba2c5ea51f5b8d590422faedf7cd4bc3912aad5deb4afc9929a096b3407cd43fa77045c508de6dc3b4aa1565aba0
SSDEEP 24576:DAHnh+eWsN3skA4RV1Hom2KXMmHaHthte8j3c1ohu75Jd7AqoIoZ2Int5:Oh+ZkldoPK8Ya/A8JXP2In
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 2540	3040	RFQ.NO_8877376398273.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ.NO_8877376398273.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3040	RFQ.NO_8877376398273.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3040	RFQ.NO_8877376398273.exe
3040	RFQ.NO_8877376398273.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3040	RFQ.NO_8877376398273.exe
3040	RFQ.NO_8877376398273.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2540	3040	RFQ.NO_8877376398273.exe	30
PID 3040 wrote to memory of 2540	3040	RFQ.NO_8877376398273.exe	30
PID 3040 wrote to memory of 2540	3040	RFQ.NO_8877376398273.exe	30
PID 3040 wrote to memory of 2540	3040	RFQ.NO_8877376398273.exe	30
PID 3040 wrote to memory of 2540	3040	RFQ.NO_8877376398273.exe	30

C:\Users\Admin\AppData\Local\Temp\RFQ.NO_8877376398273.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO_8877376398273.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ.NO_8877376398273.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ghauts

Path C:\Users\Admin\AppData\Local\Temp\ghauts
Size 282KB
SHA256 845026a23c9cfc34bbcaa0660011b6779966a96a29507f61574fb86fcaf300f5
MD5 872f0267f7205fbe5a4d24ec6690d7a9
SHA1 794a8ac4d7a5c5b87df84f8eb69b2c2a0701d44a
SHA512 fd0ce7b6935c4e36529c378b162fb6727c33acf48c11405ea7d9557548296cefe11574383d1fed06704e7646cdbd9a49f3f0b445880ea8c9e6802e8f0f03aab5
SSDEEP 6144:lbMeGcTWu3CXuVa0/kXokrM8M6N6Tu+XXgVDMGTixgW:l3GyguVa0/oXrM8M6Ku+XXgqqygW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2540-13-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2540-14-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2540-15-0x0000000000860000-0x0000000000B63000-memory.dmp

Download

memory/2540-16-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3040-12-0x0000000000630000-0x0000000000634000-memory.dmp

Download