Analysis
-
max time kernel
83s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 06:01
Static task
static1
Behavioral task
behavioral1
Sample
Rfq clarifications.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Rfq clarifications.exe
Resource
win10v2004-20220414-en
General
-
Target
Rfq clarifications.exe
-
Size
25KB
-
MD5
bc48ec658d3ae45d8eaf52b6f1ab75fd
-
SHA1
6af36a0768884ad9fd39507911d824d1dc2963db
-
SHA256
3c42490be13ea791feda53e89f19abc2c4326cc581e9f7fb4040340e38b5a7c6
-
SHA512
76a034e57bb0d6c7159853b1ed78d374b57d55f14d464e49ece07f3e73633bc51eb07b65b708d5288cecfef17d3e6a25706cb2fd00bda0ae4465bb41472a3178
Malware Config
Extracted
Protocol: smtp- Host:
mail.modernsystemsco.com - Port:
587 - Username:
[email protected] - Password:
Base@2222$
Extracted
agenttesla
Protocol: smtp- Host:
mail.modernsystemsco.com - Port:
587 - Username:
[email protected] - Password:
Base@2222$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
-
suricata: ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
suricata: ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Rfq clarifications.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation Rfq clarifications.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe" MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Rfq clarifications.exedescription pid process target process PID 3000 set thread context of 2344 3000 Rfq clarifications.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4876 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Rfq clarifications.exeMSBuild.exepid process 3000 Rfq clarifications.exe 3000 Rfq clarifications.exe 2344 MSBuild.exe 2344 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Rfq clarifications.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 3000 Rfq clarifications.exe Token: SeDebugPrivilege 2344 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Rfq clarifications.execmd.exedescription pid process target process PID 3000 wrote to memory of 208 3000 Rfq clarifications.exe cmd.exe PID 3000 wrote to memory of 208 3000 Rfq clarifications.exe cmd.exe PID 3000 wrote to memory of 208 3000 Rfq clarifications.exe cmd.exe PID 208 wrote to memory of 4876 208 cmd.exe timeout.exe PID 208 wrote to memory of 4876 208 cmd.exe timeout.exe PID 208 wrote to memory of 4876 208 cmd.exe timeout.exe PID 3000 wrote to memory of 2344 3000 Rfq clarifications.exe MSBuild.exe PID 3000 wrote to memory of 2344 3000 Rfq clarifications.exe MSBuild.exe PID 3000 wrote to memory of 2344 3000 Rfq clarifications.exe MSBuild.exe PID 3000 wrote to memory of 2344 3000 Rfq clarifications.exe MSBuild.exe PID 3000 wrote to memory of 2344 3000 Rfq clarifications.exe MSBuild.exe PID 3000 wrote to memory of 2344 3000 Rfq clarifications.exe MSBuild.exe PID 3000 wrote to memory of 2344 3000 Rfq clarifications.exe MSBuild.exe PID 3000 wrote to memory of 2344 3000 Rfq clarifications.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rfq clarifications.exe"C:\Users\Admin\AppData\Local\Temp\Rfq clarifications.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 302⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 303⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/208-131-0x0000000000000000-mapping.dmp
-
memory/2344-133-0x0000000000000000-mapping.dmp
-
memory/2344-134-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2344-135-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/2344-136-0x0000000005860000-0x00000000058FC000-memory.dmpFilesize
624KB
-
memory/2344-137-0x00000000065C0000-0x0000000006626000-memory.dmpFilesize
408KB
-
memory/2344-138-0x0000000006BD0000-0x0000000006C20000-memory.dmpFilesize
320KB
-
memory/2344-139-0x0000000006ED0000-0x0000000006F62000-memory.dmpFilesize
584KB
-
memory/2344-140-0x0000000006E90000-0x0000000006E9A000-memory.dmpFilesize
40KB
-
memory/3000-130-0x0000000000850000-0x000000000085C000-memory.dmpFilesize
48KB
-
memory/4876-132-0x0000000000000000-mapping.dmp