Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/12/2024, 08:19
General
- Target qoutation.scr.exe
- Size 1.2MB
- Sample241204-j7tvmavjfp
- SHA256 fa99e2f911527e6bd382f08adb2fa80ac6f59a6fcc84907592632ecc4eb3effa
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"C:\Users\Admin\AppData\Local\Temp\qoutation.scr.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
qoutation.scr.exe.log
__PSScriptPolicyTest_kdj4hbwd.dar.ps1
memory/844-35-0x0000000006770000-0x000000000678E000-memory.dmp
memory/844-48-0x0000000006D40000-0x0000000006D5E000-memory.dmp
memory/844-56-0x0000000007CD0000-0x0000000007CE4000-memory.dmp
memory/844-55-0x0000000007CC0000-0x0000000007CCE000-memory.dmp
memory/844-54-0x0000000007C90000-0x0000000007CA1000-memory.dmp
memory/844-53-0x0000000007D10000-0x0000000007DA6000-memory.dmp
memory/844-52-0x0000000007B00000-0x0000000007B0A000-memory.dmp
memory/844-50-0x00000000080D0000-0x000000000874A000-memory.dmp
memory/844-51-0x0000000007A90000-0x0000000007AAA000-memory.dmp
memory/844-65-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/844-49-0x0000000007990000-0x0000000007A33000-memory.dmp
memory/844-14-0x0000000002E40000-0x0000000002E76000-memory.dmp
memory/844-36-0x00000000067A0000-0x00000000067EC000-memory.dmp
memory/844-58-0x0000000007DD0000-0x0000000007DEA000-memory.dmp
memory/844-17-0x0000000005960000-0x0000000005F88000-memory.dmp
memory/844-19-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/844-18-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/844-20-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/844-61-0x0000000007DB0000-0x0000000007DB8000-memory.dmp
memory/844-29-0x0000000006040000-0x00000000060A6000-memory.dmp
memory/844-28-0x0000000005840000-0x00000000058A6000-memory.dmp
memory/844-38-0x000000006FF50000-0x000000006FF9C000-memory.dmp
memory/844-30-0x00000000061B0000-0x0000000006504000-memory.dmp
memory/844-22-0x00000000057A0000-0x00000000057C2000-memory.dmp
memory/844-37-0x0000000007750000-0x0000000007782000-memory.dmp
memory/1556-0-0x00000000747DE000-0x00000000747DF000-memory.dmp
memory/1556-3-0x0000000005880000-0x0000000005912000-memory.dmp
memory/1556-1-0x0000000000D30000-0x0000000000E62000-memory.dmp
memory/1556-15-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/1556-2-0x0000000005D90000-0x0000000006334000-memory.dmp
memory/1556-10-0x000000000AFF0000-0x000000000B08C000-memory.dmp
memory/1556-9-0x0000000007550000-0x0000000007622000-memory.dmp
memory/1556-8-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/1556-7-0x00000000747DE000-0x00000000747DF000-memory.dmp
memory/1556-6-0x0000000006E80000-0x0000000006E98000-memory.dmp
memory/1556-5-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/1556-4-0x0000000005A10000-0x0000000005A1A000-memory.dmp
memory/5020-62-0x0000000008180000-0x00000000081BC000-memory.dmp
memory/5020-57-0x00000000086C0000-0x0000000008CD8000-memory.dmp
memory/5020-59-0x00000000081F0000-0x00000000082FA000-memory.dmp
memory/5020-60-0x0000000008120000-0x0000000008132000-memory.dmp
memory/5020-21-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/5020-16-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/5020-11-0x0000000000400000-0x000000000048C000-memory.dmp
memory/5020-66-0x0000000008D60000-0x0000000008DD6000-memory.dmp
memory/5020-67-0x0000000008D00000-0x0000000008D1E000-memory.dmp
memory/5020-68-0x0000000009B10000-0x0000000009CD2000-memory.dmp
memory/5020-69-0x000000000A210000-0x000000000A73C000-memory.dmp
memory/5020-70-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/5020-71-0x00000000747D0000-0x0000000074F80000-memory.dmp