f1c78375e440265596e7ad6db872892cd19091b8d76ed62ed6cfad1439a827e5

General

Target

RFQ_List.exe
Size

905KB
MD5

27393ac93e0c60c934afa5ccdfc7c529
SHA1

e1989ce514efd53819be62e8aa4c51975da0b3e0
SHA256

66f7ca7287b5118119d8e6b8d55222d7662da16c12345a6122a28b64702ae69b
SHA512

672583e3937f3f5f5e84843913da032d5f6d6d32c759758e37710dff340973f9f0c77fb8f5b7b176b26edddec5851aa4902deb103b277b7403ea57d88292b438
SSDEEP

24576:dbusrIDaWLwBhB9XE/2D6lm7Pytae6/B1GX:SX8zB9XQ2gm7OjGB1GX

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe
2884	powershell.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Nebengeschfter.ini	RFQ_List.exe
File opened for modification	C:\Windows\resources\0409\gildes.lak	RFQ_List.exe
File opened for modification	C:\Windows\Fonts\thyrididae.ini	RFQ_List.exe
File opened for modification	C:\Windows\resources\0409\diaspidine.Inq	RFQ_List.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ_List.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	powershell.exe
2584	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2884	2692	RFQ_List.exe	30
PID 2692 wrote to memory of 2884	2692	RFQ_List.exe	30
PID 2692 wrote to memory of 2884	2692	RFQ_List.exe	30
PID 2692 wrote to memory of 2884	2692	RFQ_List.exe	30
PID 2692 wrote to memory of 2584	2692	RFQ_List.exe	32
PID 2692 wrote to memory of 2584	2692	RFQ_List.exe	32
PID 2692 wrote to memory of 2584	2692	RFQ_List.exe	32
PID 2692 wrote to memory of 2584	2692	RFQ_List.exe	32

C:\Users\Admin\AppData\Local\Temp\RFQ_List.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_List.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Noncuriousness=Get-Content -raw 'C:\Users\Admin\AppData\Local\peritonealizing\nomadeinvasioners\stofhandskernes\Maidenliness.Hal37';$Objektiviserende=$Noncuriousness.SubString(53938,3);.$Objektiviserende($Noncuriousness)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Noncuriousness=Get-Content -raw 'C:\Users\Admin\AppData\Local\peritonealizing\nomadeinvasioners\stofhandskernes\Maidenliness.Hal37';$Objektiviserende=$Noncuriousness.SubString(53938,3);.$Objektiviserende($Noncuriousness)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Damascenere.lnk

Filesize
803B

MD5
47027ef7e3a1709e131ffb08a50b6be2

SHA1
1516a214287a748dd3e02d73d8373a0baeddf352

SHA256
4997726a61b3c10d6a7ed878463f680007b13dcd9533aa310b28888967d17d32

SHA512
90d60995db3dca664f59a3780e7b141bc66fee80034d0372e2e8e90baf6acbc6ed8ca6da25e8d937a24b4aec057c260762fd351e4dd73f1a7aa179a4d87298ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Damascenere.lnk

Filesize
849B

MD5
6360326ff32b3e9c06a20d4e2b8560c8

SHA1
7eb8fc3a299adff3332a7b2c962137df4431cf9e

SHA256
9b3ad140abafc7c5d962bf9fcb5863cc54125ba0a81abdb0448600160708d4c1

SHA512
6b777dce919e436ce80fd52d48b9ffb335e646853be7f2bb64fe4635ded2bd35506f500af339ea921d7a5dbe93b173874956f77c783c06f7c86261ac7b49f87a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
246f20abc9303cac0ac1a5b794f29e3c

SHA1
6c52949eef9c1a891ccb3cc8d3e755c77e19e8af

SHA256
e2ff6604232c901f41332b2f2b85909ce9a9ccd84937121467d00c4f9d060437

SHA512
8e794823f6c2619de9bf6bd4296a6d24cf34246d6eab8abc02810f4488ab2eaeadc4423ab9c75ce93b9a3c1fc819d575c6f39911c31da2c80f5e94419bdfef06

Download Submit
C:\Windows\Resources\Nebengeschfter.ini

Filesize
32B

MD5
53898e643bd3e0ca22a462325ad62da4

SHA1
e0f08a75fa5219f39e49c1b9f361119905da7d02

SHA256
b947991000aea669ebfeadfb12de45121d46ad3dfd02296f373f9bf8ce4f1aff

SHA512
aa17b99a93a04f7bbbb92f34c15921da80e20592a39b3921f1d3cc59fae55f66196b2be4f56716846daff041253cb63d7e373b84234d451181c87f1d097fe8ca

Download Submit
memory/2884-169-0x0000000073801000-0x0000000073802000-memory.dmp

Filesize
4KB

Download
memory/2884-170-0x0000000073800000-0x0000000073DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2884-171-0x0000000073800000-0x0000000073DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2884-173-0x0000000073800000-0x0000000073DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2884-172-0x0000000073800000-0x0000000073DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2884-323-0x0000000073800000-0x0000000073DAB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing