Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 14:24
Static task
static1
Behavioral task
behavioral1
Sample
URGENT REQUEST FOR QUOTATION.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
URGENT REQUEST FOR QUOTATION.exe
Resource
win10v2004-20231130-en
General
-
Target
URGENT REQUEST FOR QUOTATION.exe
-
Size
645KB
-
MD5
713ecfa2ce41e3edee829b9a4f9b5c74
-
SHA1
c23cf057a296df55472ceaab86bc9637cfea0f2d
-
SHA256
3af8e8d96431992127c5774977cb7b3ea300c4ef8b23a620f0213f42b79584d9
-
SHA512
9903dde3c8cc3fd7f945661f62afdecd06a391a895f6ba784395b911321e83f16e678b5c601b73416e1b3235d22ceaa5323eacc94afc609ff5db6c88d08606bf
-
SSDEEP
12288:2kvQaueH5qi/Uqiwq7ay1Lc2wlyoVnqC52sour7aMvi:2ktqi/tiwquy19QyoVXQhurP
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.precise.co.in - Port:
587 - Username:
[email protected] - Password:
Singh@2022$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1514849007-2165033493-4114354048-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exedescription pid process target process PID 1620 set thread context of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exepowershell.exepowershell.exeRegSvcs.exepid process 1620 URGENT REQUEST FOR QUOTATION.exe 1620 URGENT REQUEST FOR QUOTATION.exe 1620 URGENT REQUEST FOR QUOTATION.exe 1620 URGENT REQUEST FOR QUOTATION.exe 1620 URGENT REQUEST FOR QUOTATION.exe 1620 URGENT REQUEST FOR QUOTATION.exe 2844 powershell.exe 2936 powershell.exe 1620 URGENT REQUEST FOR QUOTATION.exe 1620 URGENT REQUEST FOR QUOTATION.exe 1620 URGENT REQUEST FOR QUOTATION.exe 2696 RegSvcs.exe 2696 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1620 URGENT REQUEST FOR QUOTATION.exe Token: SeDebugPrivilege 2844 powershell.exe Token: SeDebugPrivilege 2936 powershell.exe Token: SeDebugPrivilege 2696 RegSvcs.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exedescription pid process target process PID 1620 wrote to memory of 2844 1620 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 1620 wrote to memory of 2844 1620 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 1620 wrote to memory of 2844 1620 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 1620 wrote to memory of 2844 1620 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 1620 wrote to memory of 2936 1620 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 1620 wrote to memory of 2936 1620 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 1620 wrote to memory of 2936 1620 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 1620 wrote to memory of 2936 1620 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 1620 wrote to memory of 2884 1620 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 1620 wrote to memory of 2884 1620 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 1620 wrote to memory of 2884 1620 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 1620 wrote to memory of 2884 1620 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 1620 wrote to memory of 2596 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2596 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2596 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2596 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2596 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2596 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2596 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 1620 wrote to memory of 2696 1620 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kVbSXFovGp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kVbSXFovGp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7021.tmp"2⤵
- Creates scheduled task(s)
PID:2884 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2596
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ef8a069d03e6d298902e0b2061b44374
SHA13c2f585f1abb669ccd6df5f432c31c8bcf379cc5
SHA25628cad524888b7a470db8728460359b8ee154fec0748b7bfc4d55549c2105518f
SHA512d270bcbcc67fabcd1a48e69cd990585d1b7dbe1dca0748fcfff6f39231de7dac8ce0868b50c40bdd0e2553a4d91c0dafd9a616dfecf1b6bd109ae325e861655b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PF8TK67PIKYUMR8KS42P.temp
Filesize7KB
MD59eb5f8732a1702c8a42e36d4a1eed3cd
SHA1edc85072d37046a927de1fe29060192d369bf89b
SHA25666655bb5e3eaff3976072e045c680ada06efebe1f2dcf5ebc9db804d4273504a
SHA5122927968f48a862b5c6f794bbd70bed8e9a5c1d88ea09e95f4edbe87763afb4f5e83397a180a80b1680ba9680db9764be4d2b68fbf1bdd93911860e4208c68934
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD59eb5f8732a1702c8a42e36d4a1eed3cd
SHA1edc85072d37046a927de1fe29060192d369bf89b
SHA25666655bb5e3eaff3976072e045c680ada06efebe1f2dcf5ebc9db804d4273504a
SHA5122927968f48a862b5c6f794bbd70bed8e9a5c1d88ea09e95f4edbe87763afb4f5e83397a180a80b1680ba9680db9764be4d2b68fbf1bdd93911860e4208c68934