7f4efe9dd0de55d09d565ec4c01473fda81224c185ca1976b5f2fd117ebfaeb9

Analysis

max time kernel
149s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
06/11/2025, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ 7654545-P,OUAE.exe
Size 842KB
Sample251106-mkn8eavpak
SHA256 7f4efe9dd0de55d09d565ec4c01473fda81224c185ca1976b5f2fd117ebfaeb9
MD5 f0288e05316fa970020d068e6cf2b501
SHA1 1b7951d8b3c03ad584d5f1aaa84ebefe52a63172
SHA512 ddcd9e14ba49de4fa95dd8b5b584c3eca345403df52b77eb3ddf141316bf942c0381a72ee4b7908b932faa232823e42d793b6cbe19c598295c06d0c567b99337
SSDEEP 12288:5Ov5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi7xwHCnovVOmfqWrDdmu7Vk3Q:5q5TfcdHj4fmbgwH0odFqW397KA
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5840-17-0x0000000000330000-0x0000000000505000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5840 set thread context of 4732	5840	RFQ 7654545-P,OUAE.exe	79

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5840-0-0x0000000000330000-0x0000000000505000-memory.dmp	upx
behavioral2/memory/5840-17-0x0000000000330000-0x0000000000505000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5492	5840	WerFault.exe	78
1840	4732	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ 7654545-P,OUAE.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5840	RFQ 7654545-P,OUAE.exe
5840	RFQ 7654545-P,OUAE.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5840	RFQ 7654545-P,OUAE.exe
5840	RFQ 7654545-P,OUAE.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5840	RFQ 7654545-P,OUAE.exe
5840	RFQ 7654545-P,OUAE.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 4732	5840	RFQ 7654545-P,OUAE.exe	79
PID 5840 wrote to memory of 4732	5840	RFQ 7654545-P,OUAE.exe	79
PID 5840 wrote to memory of 4732	5840	RFQ 7654545-P,OUAE.exe	79
PID 5840 wrote to memory of 4732	5840	RFQ 7654545-P,OUAE.exe	79

C:\Users\Admin\AppData\Local\Temp\RFQ 7654545-P,OUAE.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 7654545-P,OUAE.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ 7654545-P,OUAE.exe"
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 204
    3⤵
    - Program crash
    PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 784
  2⤵
  - Program crash
  PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5840 -ip 5840
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4732 -ip 4732
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut65C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut65C0.tmp
Size 287KB
SHA256 35e7f13fb10b7e89eab56259f13ca102faa86f693aaadcb7b1e53b3621af489f
MD5 6876925d29fbdc84e6941c6fe816178d
SHA1 141fba9635bade0ed1e9eb1fa8fd3bbb1198243b
SHA512 456a1e99837def505ce058cd3c4070dace0c6daaad9c21bae071b0471263f17c25675eb83e2e25d7897a4c263f60970d12312ac2fae1ceee519f8f3bb2805832
SSDEEP 6144:VGiB6jdTIlYZtMRX0yHFX5yqojGw0l9mhrHPnv+Xepp5tC:fBOdT82tMGrqoyIJv+Opp5tC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4732-14-0x0000000000600000-0x0000000000648000-memory.dmp

Download

memory/5840-0-0x0000000000330000-0x0000000000505000-memory.dmp

Download

memory/5840-13-0x00000000018B0000-0x0000000001CB0000-memory.dmp

Download

memory/5840-17-0x0000000000330000-0x0000000000505000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads