Analysis
- max time kernel
148s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
17/07/2026, 03:48
General
- Target RFQ 20260731392 _ Request for Proposal.exe
- Size 1.2MB
- Sample260717-ecvq8aaw4m
- SHA256 9aa928b433983f53758e42961aa0cf8096a4211a5562bfcd7ba3cb63d902282b
Malware Config
Signatures
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ 20260731392 _ Request for Proposal.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 20260731392 _ Request for Proposal.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" all --output-path "C:\Users\Admin\AppData\Local\Temp\51eb426a810c353d048fc88198c14485"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/348-16-0x00007FFDF023F000-0x00007FFDF0240000-memory.dmp
memory/348-21-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/348-18-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/348-17-0x0000016821210000-0x0000016821220000-memory.dmp
memory/688-12-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/688-13-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/688-23-0x0000000006520000-0x0000000006596000-memory.dmp
memory/688-22-0x0000000006670000-0x0000000006832000-memory.dmp
memory/688-20-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/688-19-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/688-14-0x00000000051A0000-0x0000000005206000-memory.dmp
memory/688-11-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5780-9-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/5780-0-0x0000000074322000-0x0000000074323000-memory.dmp
memory/5780-10-0x0000000006600000-0x00000000066FE000-memory.dmp
memory/5780-15-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/5780-4-0x0000000005120000-0x000000000512A000-memory.dmp
memory/5780-3-0x0000000005080000-0x0000000005112000-memory.dmp
memory/5780-2-0x0000000005640000-0x0000000005BFA000-memory.dmp
memory/5780-5-0x0000000005290000-0x000000000532C000-memory.dmp
memory/5780-8-0x0000000074322000-0x0000000074323000-memory.dmp
memory/5780-1-0x0000000000430000-0x0000000000560000-memory.dmp
memory/5780-7-0x0000000005180000-0x0000000005190000-memory.dmp
memory/5780-6-0x0000000074310000-0x0000000074ACC000-memory.dmp