Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-11-2024 05:19
General
-
Target
Request for Quotation.exe
-
Size
813KB
-
MD5
aa574ed0656465c43af1746edb63d444
-
SHA1
ced45184631fd4a5dd35c4460eff67c7e494381a
-
SHA256
34cb680a202b85f7c3e56c56951d100280404b0ad1df153db134a93849c031b4
-
SHA512
e6e14ad30436ecbe6d44925ea3b842d809b5544bf474ad7067bd20d8373c6f95e7eacfdeae1a0bea0ad116dc4d96b33645593f20c08109b00cdfad5a98aa4f14
-
SSDEEP
24576:E1Maxj0GNV2K612jmPqDcKWaeK3a7IPDcLJM:EmaOGNC12UqDcKWaVPAG
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
3.3MB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
3.3MB
-
Filesize
40KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
840KB