Analysis
-
max time kernel
60s -
max time network
42s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 14:19
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v200430
General
-
Target
Quotation.exe
-
Size
665KB
-
MD5
23d87ff513747459238551157eb4e4c3
-
SHA1
867d658600f1c5c1bc8a2c1786fda5ea182c681f
-
SHA256
13444c52c094b2067a66767847b8a2151da087a99c9391a2547a53a3e4de7056
-
SHA512
d5437a2d691b5b7aa5305b98bd004089499e7c1e60c25a9740eb2c0a808738e5f18aa6809822bbd1a9438c194265087fa767c0fc0d1687e334a65d676af8cae3
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Quotation.exeQuotation.exepid process 1492 Quotation.exe 276 Quotation.exe 276 Quotation.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Quotation.exedescription pid process target process PID 1492 wrote to memory of 276 1492 Quotation.exe Quotation.exe PID 1492 wrote to memory of 276 1492 Quotation.exe Quotation.exe PID 1492 wrote to memory of 276 1492 Quotation.exe Quotation.exe PID 1492 wrote to memory of 276 1492 Quotation.exe Quotation.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quotation.exedescription pid process target process PID 1492 set thread context of 276 1492 Quotation.exe Quotation.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral1/memory/276-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral1/memory/276-2-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral1/memory/276-3-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Quotation.exepid process 1492 Quotation.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Quotation.exedescription pid process Token: SeDebugPrivilege 276 Quotation.exe -
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:276