Analysis
- max time kernel
93s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
06/03/2025, 08:24
General
- Target RFQ, MR# 2511004287 & 2511004288.exe
- Size 1.1MB
- Sample250306-karvfatte1
- SHA256 d4771040c76dca1e55f72d53e5d4866c2b22ef12cb48d18a291bbf3cd35484bb
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ, MR# 2511004287 & 2511004288.exe"C:\Users\Admin\AppData\Local\Temp\RFQ, MR# 2511004287 & 2511004288.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ, MR# 2511004287 & 2511004288.exe"C:\Users\Admin\AppData\Local\Temp\RFQ, MR# 2511004287 & 2511004288.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4592-14-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4592-19-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4592-18-0x00000000015E0000-0x000000000192A000-memory.dmp
memory/4592-17-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4896-8-0x0000000006D20000-0x0000000006D32000-memory.dmp
memory/4896-11-0x000000007494E000-0x000000007494F000-memory.dmp
memory/4896-6-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4896-7-0x00000000053D0000-0x00000000053DA000-memory.dmp
memory/4896-0-0x000000007494E000-0x000000007494F000-memory.dmp
memory/4896-9-0x0000000006D70000-0x0000000006D92000-memory.dmp
memory/4896-10-0x0000000006D50000-0x0000000006D60000-memory.dmp
memory/4896-5-0x0000000005DF0000-0x0000000005E8C000-memory.dmp
memory/4896-12-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4896-13-0x0000000006A90000-0x0000000006B22000-memory.dmp
memory/4896-4-0x0000000005470000-0x00000000057C4000-memory.dmp
memory/4896-16-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4896-3-0x0000000005290000-0x0000000005322000-memory.dmp
memory/4896-2-0x0000000005840000-0x0000000005DE4000-memory.dmp
memory/4896-1-0x0000000000730000-0x000000000085A000-memory.dmp