662fef8b4f1d3b467039e66b6c6c415583bca1cb49adf66dbf900d4c48f35db1

General

Target
Kestrel GTCC Pvt Ltd RFQ_xls.exe
Size 528KB
Sample200716-dlecsyk632
SHA256 662fef8b4f1d3b467039e66b6c6c415583bca1cb49adf66dbf900d4c48f35db1
MD5 90056f0f953f5973c5a29bc050fd1fce
SHA1 bfd9c6630773bd6c3be73da381311db92e676b5d
SHA512 bd66fb846bc585a66347312da1cf1611457bdccc84feb6f35cc13fde7426fa1f934b692b3fcd68d37deaa53aa94bb488bece94124819607dbdc654cc6312eb45
MD5 SHA1 SHA512

Score

7^/10

spyware

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1824	RegSvcs.exe
1824	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1496	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1496	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	24
PID 112 wrote to memory of 1496	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	24
PID 112 wrote to memory of 1496	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	24
PID 112 wrote to memory of 1496	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	24
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26
PID 112 wrote to memory of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 112 set thread context of 1824	112	Kestrel GTCC Pvt Ltd RFQ_xls.exe	26

C:\Users\Admin\AppData\Local\Temp\Kestrel GTCC Pvt Ltd RFQ_xls.exe
"C:\Users\Admin\AppData\Local\Temp\Kestrel GTCC Pvt Ltd RFQ_xls.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:112
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CgjZHAzU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD632.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1496
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1824