Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 14:27
Static task
static1
Behavioral task
behavioral1
Sample
URGENT REQUEST FOR QUOTATION.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
URGENT REQUEST FOR QUOTATION.exe
Resource
win10v2004-20231130-en
General
-
Target
URGENT REQUEST FOR QUOTATION.exe
-
Size
645KB
-
MD5
713ecfa2ce41e3edee829b9a4f9b5c74
-
SHA1
c23cf057a296df55472ceaab86bc9637cfea0f2d
-
SHA256
3af8e8d96431992127c5774977cb7b3ea300c4ef8b23a620f0213f42b79584d9
-
SHA512
9903dde3c8cc3fd7f945661f62afdecd06a391a895f6ba784395b911321e83f16e678b5c601b73416e1b3235d22ceaa5323eacc94afc609ff5db6c88d08606bf
-
SSDEEP
12288:2kvQaueH5qi/Uqiwq7ay1Lc2wlyoVnqC52sour7aMvi:2ktqi/tiwquy19QyoVXQhurP
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.precise.co.in - Port:
587 - Username:
[email protected] - Password:
Singh@2022$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exedescription pid process target process PID 2176 set thread context of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exepowershell.exepowershell.exepid process 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2736 powershell.exe 2688 powershell.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe 2176 URGENT REQUEST FOR QUOTATION.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2176 URGENT REQUEST FOR QUOTATION.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exedescription pid process target process PID 2176 wrote to memory of 2736 2176 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 2176 wrote to memory of 2736 2176 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 2176 wrote to memory of 2736 2176 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 2176 wrote to memory of 2736 2176 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 2176 wrote to memory of 2688 2176 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 2176 wrote to memory of 2688 2176 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 2176 wrote to memory of 2688 2176 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 2176 wrote to memory of 2688 2176 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 2176 wrote to memory of 2640 2176 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 2176 wrote to memory of 2640 2176 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 2176 wrote to memory of 2640 2176 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 2176 wrote to memory of 2640 2176 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 2176 wrote to memory of 2764 2176 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kVbSXFovGp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kVbSXFovGp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBB92.tmp"2⤵
- Creates scheduled task(s)
PID:2640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52f3ae08b7c65cf8d757747f04068c3f6
SHA1c24b015ff93f20c04150f3d342fde078b3701fe8
SHA256e6f51d24dce551d54b1cdb311b1e29a7957eb107d9e64d7d8e60c95be5537331
SHA512f4e976ea3ba27418c37bba578a62a970d1ae985b031b8d002c0b948ff8e9d3fc57f8364ef6c50cdc28346811bb2214118e2cbce4dc8f38d1bd2b6ef24b2dca1e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0ALICW2L98PTW9PUE7IB.temp
Filesize7KB
MD5c1164e411b3b3e9bb20232365fd6dd02
SHA10bdcc38a9eba9861bc12420cdb244802059aeafe
SHA25647d9a196610f58115ce46ccb49bf6a6b7a39390fdab042c67ef15173cc179130
SHA5127da8c4e6ea801a9962030ff3ff8c76478bcb5788f63ad6ae50912ac4851713700db82fdd9e90619d15df76cb372d6866867bc2674cd384438b7208d0090f82f9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5c1164e411b3b3e9bb20232365fd6dd02
SHA10bdcc38a9eba9861bc12420cdb244802059aeafe
SHA25647d9a196610f58115ce46ccb49bf6a6b7a39390fdab042c67ef15173cc179130
SHA5127da8c4e6ea801a9962030ff3ff8c76478bcb5788f63ad6ae50912ac4851713700db82fdd9e90619d15df76cb372d6866867bc2674cd384438b7208d0090f82f9