662fef8b4f1d3b467039e66b6c6c415583bca1cb49adf66dbf900d4c48f35db1

General

Target
Kestrel GTCC Pvt Ltd RFQ_xls.exe
Size 528KB
Sample200716-dlecsyk632
SHA256 662fef8b4f1d3b467039e66b6c6c415583bca1cb49adf66dbf900d4c48f35db1
MD5 90056f0f953f5973c5a29bc050fd1fce
SHA1 bfd9c6630773bd6c3be73da381311db92e676b5d
SHA512 bd66fb846bc585a66347312da1cf1611457bdccc84feb6f35cc13fde7426fa1f934b692b3fcd68d37deaa53aa94bb488bece94124819607dbdc654cc6312eb45
MD5 SHA1 SHA512

Score

7^/10

spyware

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3596	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	72
PID 1600 wrote to memory of 3596	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	72
PID 1600 wrote to memory of 3596	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	72
PID 1600 wrote to memory of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74
PID 1600 wrote to memory of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74
PID 1600 wrote to memory of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74
PID 1600 wrote to memory of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74
PID 1600 wrote to memory of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74
PID 1600 wrote to memory of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74
PID 1600 wrote to memory of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74
PID 1600 wrote to memory of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1600 set thread context of 3036	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe	74

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe
Token: SeDebugPrivilege	3036	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1600	Kestrel GTCC Pvt Ltd RFQ_xls.exe
3036	RegSvcs.exe
3036	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3596	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Kestrel GTCC Pvt Ltd RFQ_xls.exe
"C:\Users\Admin\AppData\Local\Temp\Kestrel GTCC Pvt Ltd RFQ_xls.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1600
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CgjZHAzU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA917.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3596
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3036