RFQ 242024[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RFQ 242024.exe
Size 1.1MB
Sample241024-wgcvmsvana
SHA256 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637
MD5 5fa5f00b74bf9bb524687e6785027135
SHA1 4f41d3eddbf7844cc60f561c6fd92c44f7f4f282
SHA512 5bbd12cb28e0255a6773e11c2c096a94ec018228dd8dfae107efdd4bb193808463849872175f9798de27705fa5f9b5232bc10ef18c726ebee3c222aa3b2b3f9f
SSDEEP 24576:WfmMv6Ckr7Mny5QtEc7e74/SPFjc2+ZWKrs3bC+:W3v+7/5Qtl7k4/S1tGJaC+
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RFQ 242024.exe

File Explorer

RFQ 242024.exe

.exe 1.1MB

RFQ 242024.exe

IMPHASH 870b8e75c7190e202e9c6c81dff1040c
SHA256 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637
MD5 5fa5f00b74bf9bb524687e6785027135
SHA1 4f41d3eddbf7844cc60f561c6fd92c44f7f4f282
SHA512 5bbd12cb28e0255a6773e11c2c096a94ec018228dd8dfae107efdd4bb193808463849872175f9798de27705fa5f9b5232bc10ef18c726ebee3c222aa3b2b3f9f
SSDEEP 24576:WfmMv6Ckr7Mny5QtEc7e74/SPFjc2+ZWKrs3bC+:W3v+7/5Qtl7k4/S1tGJaC+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

__WSAFDIsSet setsockopt ntohs recvfrom sendto htons select listen WSAStartup bind closesocket connect socket send WSACleanup ioctlsocket accept WSAGetLastError inet_addr gethostbyname gethostname recv

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx ImageList_Destroy

mpr

WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W WNetUseConnectionW

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetConnectW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetQueryOptionW InternetQueryDataAvailable

psapi

EnumProcesses GetModuleBaseNameW GetProcessMemoryInfo EnumProcessModules

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW

kernel32

HeapAlloc Sleep GetCurrentThreadId RaiseException MulDiv GetVersionExW GetSystemInfo MultiByteToWideChar WideCharToMultiByte GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose DeleteFileW FindNextFileW lstrcmpiW MoveFileW CopyFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource GetProcessHeap OutputDebugStringW GetLocalTime CompareStringW CompareStringA InterlockedIncrement InterlockedDecrement DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetStdHandle CreatePipe InterlockedExchange TerminateThread GetTempPathW GetTempFileNameW VirtualFree FormatMessageW GetExitCodeProcess SetErrorMode GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW DeviceIoControl SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetComputerNameW GetWindowsDirectoryW GetSystemDirectoryW GetCurrentProcessId GetCurrentThread GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc LoadLibraryExW HeapFree WaitForSingleObject CreateThread DuplicateHandle GetLastError CloseHandle GetCurrentProcess GetProcAddress LoadLibraryA FreeLibrary GetModuleFileNameW GetFullPathNameW ExitProcess ExitThread GetSystemTimeAsFileTime SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW ResumeThread GetStartupInfoW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameA HeapReAlloc HeapCreate SetHandleCount GetFileType GetStartupInfoA SetStdHandle GetConsoleCP GetConsoleMode LCMapStringW LCMapStringA RtlUnwind SetFilePointer GetTimeZoneInformation GetTimeFormatA GetDateFormatA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetTickCount GetStringTypeA GetStringTypeW GetLocaleInfoA GetModuleHandleA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEndOfFile EnumResourceNamesW SetEnvironmentVariableA

user32

SetWindowPos GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW ReleaseCapture SetCapture WindowFromPoint CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem CopyImage GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW SystemParametersInfoW PeekMessageW SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity GetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW MessageBoxW DefWindowProcW MoveWindow AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate DispatchMessageW GetMenuItemID TranslateMessage SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon UnregisterHotKey CharLowerBuffW MonitorFromRect keybd_event LoadImageW GetWindowLongW

gdi32

DeleteObject GetObjectW GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits LineTo AngleArc MoveToEx Ellipse PolyDraw BeginPath Rectangle GetDeviceCaps SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject CreateDCW GetPixel DeleteDC SetViewportOrgEx

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegEnumValueW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegCreateKeyExW GetUserNameW RegConnectRegistryW RegEnumKeyExW CloseServiceHandle UnlockServiceDatabase LockServiceDatabase OpenSCManagerW InitiateSystemShutdownExW AdjustTokenPrivileges RegCloseKey RegQueryValueExW RegOpenKeyExW OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW InitializeSecurityDescriptor InitializeAcl GetLengthSid SetSecurityDescriptorDacl CopySid LogonUserW GetTokenInformation GetAclInformation GetAce AddAce GetSecurityDescriptorDacl

shell32

DragQueryPoint ShellExecuteExW SHGetFolderPathW DragQueryFileW SHEmptyRecycleBinW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoInitialize CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree CLSIDFromString StringFromCLSID IIDFromString StringFromIID OleInitialize CreateBindCtx CLSIDFromProgID CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket OleUninitialize

oleaut32

SafeArrayAllocData SafeArrayAllocDescriptorEx SysAllocString OleLoadPicture SafeArrayGetVartype SafeArrayDestroyData SafeArrayAccessData VarR8FromDec VariantTimeToSystemTime VariantClear VariantCopy VariantInit SafeArrayDestroyDescriptor LoadRegTypeLi GetActiveObject SafeArrayUnaccessData