Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 10:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RFQ – Manufacturing Inquiry.#49160.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
RFQ – Manufacturing Inquiry.#49160.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target RFQ – Manufacturing Inquiry.#49160.exe
- Size 3.4MB
- Sample260720-mpt98ae16j
- SHA256 ae8e7ad14dec25f2ba87cae1510fbba1b46de9d24e967ad92eacc5217301e9c3
- MD5 71ba598a84b31ddcf8d1d6a17b9f9ead
- SHA1 d022f6fc21d37f2f7aa1a47496bdc6a2ac8f7e71
- SHA512 034b6ef9287beb16b76c56805c5fdbe38ba7f1bc68106f93f0924e0f541f33041c9a579bdc64aef5bc6cea18347c673d565ef225520a2d58ecdf068603abf471
- SSDEEP 49152:/8rfBrvf3l2BiNmWlBJ7bIyYzwCBemWY0HvmGCp6DXBTl:/8FrH17UwPY0HvmGZXBTl
- TLSH T159F58D07BCA408E9C0AE9371C9B655963B75BC480B3267EB2B50B6783FB2BD05D79704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Windows security bypass 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths RFQ – Manufacturing Inquiry.#49160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions RFQ – Manufacturing Inquiry.#49160.exe - Executes dropped EXE 2 IoCs
pid Process 3500 STProcessMonitorDriver.sys 5784 BdApiUtil64.sys - Windows security modification 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions RFQ – Manufacturing Inquiry.#49160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions RFQ – Manufacturing Inquiry.#49160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths RFQ – Manufacturing Inquiry.#49160.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 5 raw.githubusercontent.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe 3884 RFQ – Manufacturing Inquiry.#49160.exe - Suspicious behavior: LoadsDriver 10 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3116 wrote to memory of 3884 3116 RFQ – Manufacturing Inquiry.#49160.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ – Manufacturing Inquiry.#49160.exe"C:\Users\Admin\AppData\Local\Temp\RFQ – Manufacturing Inquiry.#49160.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\RFQ – Manufacturing Inquiry.#49160.exe"C:\Users\Admin\AppData\Local\Temp\RFQ – Manufacturing Inquiry.#49160.exe"2⤵
- Windows security bypass
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:3884
-
-
C:\Users\Admin\AppData\Local\Microsoft\Update\STProcessMonitorDriver.sysC:\Users\Admin\AppData\Local\Microsoft\Update\STProcessMonitorDriver.sys1⤵
- Executes dropped EXE
PID:3500
-
C:\Users\Admin\AppData\Local\Microsoft\Update\BdApiUtil64.sysC:\Users\Admin\AppData\Local\Microsoft\Update\BdApiUtil64.sys1⤵
- Executes dropped EXE
PID:5784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Update\BdApiUtil64.sys
- Size 114KB
- SHA256 47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428
- MD5 ced47b89212f3260ebeb41682a4b95ec
- SHA1 148c0cde4f2ef807aea77d7368f00f4c519f47ef
- SHA512 d6c640464258bca2e937f04543be2944b622dbd3d229ac6719ab6c1fac0881e8dc0f77b42f0315aeba985f14c6e073af423110bda527558cd460bcaab9d71560
- SSDEEP 768:0MdM/AcPDiFhlPqbgKq0qC9bheG8FHrtjBUQEEt11l11e6O6yKo/Jqq0nGxobqkD:0LShhKYSdgpjNEEaB0BEj+9QvUb4obB
- TLSH T171B3D598D3315286D85B8272C9526791BF70F3707361E39F829251BE1D47FEB1EBA208
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Update\STProcessMonitorDriver.sys
- Size 34KB
- SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
- MD5 485a04675df7cf40a8865706e003eb25
- SHA1 711ef221526997039e804a18db9647c91680bbe2
- SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
- SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
- TLSH T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
- MD5 SHA1 SHA512 SSDEEP TLSH