Analysis
- max time kernel
145s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:05
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe
- Size 1.5MB
- Sample201109-kh4s9717ea
- SHA256 38fc7dbc46afc77e54a4810ba17964faaa85ef9ca526890306fcc2c5ecc398db
- MD5 842fe71167af1c70b6922f0ea52241cc
- SHA1 8f92301fdead6c1ab337ef9ca13f8f31e40b6373
- SHA512 a6fda379cb9874df7f6d71f82fad12a02ecadadc87a0f354890f8f7175c516bce90a84c02de4d1158aa93f9d05bb13ef3cba7fd2047151c531c25406eb4fa19a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.iotoils.com
-
Port
587
-
Username
-
Password
i)gxTLJ8
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.iotoils.com
-
Port
587
-
Username
-
Password
i)gxTLJ8
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
resource yara_rule behavioral2/memory/3076-0-0x0000000000790000-0x00000000007E2000-memory.dmp family_agenttesla behavioral2/memory/3076-1-0x00000000007DCF8E-mapping.dmp family_agenttesla - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DXCpl.url QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 540 set thread context of 3076 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 78 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3076 MSBuild.exe 3076 MSBuild.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3076 MSBuild.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 540 wrote to memory of 3076 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 78 PID 540 wrote to memory of 3076 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 78 PID 540 wrote to memory of 3076 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 78 PID 540 wrote to memory of 3076 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 78 PID 540 wrote to memory of 3076 540 QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe 78 PID 3076 wrote to memory of 2308 3076 MSBuild.exe 82 PID 3076 wrote to memory of 2308 3076 MSBuild.exe 82 PID 3076 wrote to memory of 2308 3076 MSBuild.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION#7724_250520_RFQ_NEW_OFFER_Kolortek_Co_Ltd.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:2308
-
-