Analysis
-
max time kernel
91s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2023 01:02
Static task
static1
Behavioral task
behavioral1
Sample
NEW QUOTATION.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEW QUOTATION.exe
Resource
win10v2004-20231130-en
General
-
Target
NEW QUOTATION.exe
-
Size
683KB
-
MD5
6adb7b71640a2f11f8144693e2b15d41
-
SHA1
38c3551a6b02c88e793f37b29a522071100bced6
-
SHA256
b5cd63c5fec95f16d9c11ca726e0bad76d52eb122a6458b3940d5dd94d3a7dfb
-
SHA512
d5a6bca0366b1aed4c03f70defc319e70932c18d9ca89183f08479aa8d306532a50f3e06a08fe4182ae0e86e2980b5971940dca75a5a397f48da5e26d4664c30
-
SSDEEP
12288:C4ueH5qfhisCn/zzGAfjmT0HHy5Jvjgbsfc1DhpYChjAVejJI:PqZxwG4jmT0H6Vjgbcc1Dhpbac
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.amtechcards.com - Port:
587 - Username:
[email protected] - Password:
puuAt8;(Y$NU - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 api.ipify.org 26 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW QUOTATION.exedescription pid process target process PID 3360 set thread context of 4648 3360 NEW QUOTATION.exe RegSvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3736 4648 WerFault.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
NEW QUOTATION.exeRegSvcs.exepid process 3360 NEW QUOTATION.exe 3360 NEW QUOTATION.exe 4648 RegSvcs.exe 4648 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW QUOTATION.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3360 NEW QUOTATION.exe Token: SeDebugPrivilege 4648 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
NEW QUOTATION.exedescription pid process target process PID 3360 wrote to memory of 4648 3360 NEW QUOTATION.exe RegSvcs.exe PID 3360 wrote to memory of 4648 3360 NEW QUOTATION.exe RegSvcs.exe PID 3360 wrote to memory of 4648 3360 NEW QUOTATION.exe RegSvcs.exe PID 3360 wrote to memory of 4648 3360 NEW QUOTATION.exe RegSvcs.exe PID 3360 wrote to memory of 4648 3360 NEW QUOTATION.exe RegSvcs.exe PID 3360 wrote to memory of 4648 3360 NEW QUOTATION.exe RegSvcs.exe PID 3360 wrote to memory of 4648 3360 NEW QUOTATION.exe RegSvcs.exe PID 3360 wrote to memory of 4648 3360 NEW QUOTATION.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 19803⤵
- Program crash
PID:3736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4648 -ip 46481⤵PID:400