Analysis
-
max time kernel
126s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:51
Static task
static1
Behavioral task
behavioral1
Sample
Urgent Inquiry (HEC RFQ).exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Urgent Inquiry (HEC RFQ).exe
Resource
win10v2004-20220414-en
General
-
Target
Urgent Inquiry (HEC RFQ).exe
-
Size
622KB
-
MD5
344711a513dc11fb20626acfe0a702b5
-
SHA1
585720af846999cbde9e0caa6e79fae842495470
-
SHA256
5436a7bcc453550473db1a6e439538bd0ba7c6a87577f450642dab6da0f33263
-
SHA512
c3fd35bc091a5dafadab197b8ad1f6c5e9f22eaad44e92d5bb0c3664bee8e91b49ff78e40634df35aa7d7698d83e23383359f3233e93b0f2f06f3ca79bda3981
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
spar@interiorsidea.fit - Password:
71c7eb1f8ba
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/624-59-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/624-60-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/624-62-0x000000000044756E-mapping.dmp family_agenttesla behavioral1/memory/624-61-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/624-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/624-66-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" Urgent Inquiry (HEC RFQ).exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription pid process target process PID 1788 set thread context of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exepid process 624 Urgent Inquiry (HEC RFQ).exe 624 Urgent Inquiry (HEC RFQ).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription pid process Token: SeDebugPrivilege 624 Urgent Inquiry (HEC RFQ).exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription pid process target process PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 1788 wrote to memory of 624 1788 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe -
outlook_office_path 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe -
outlook_win_path 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry (HEC RFQ).exe"C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry (HEC RFQ).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry (HEC RFQ).exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/624-57-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/624-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/624-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/624-62-0x000000000044756E-mapping.dmp
-
memory/624-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/624-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/624-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/624-68-0x0000000074AC0000-0x000000007506B000-memory.dmpFilesize
5.7MB
-
memory/1788-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1788-55-0x0000000074AC0000-0x000000007506B000-memory.dmpFilesize
5.7MB