Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quotation RFQ1310.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Request For Quotation RFQ1310.exe
Resource
win10v2004-20240419-en
General
-
Target
Request For Quotation RFQ1310.exe
-
Size
823KB
-
MD5
48c4494e4bff82d39ad2ac8173c65bfb
-
SHA1
1f7fab7375e94b25dd32bc60fc40a76f43ca8862
-
SHA256
1451b7450f81b2642b3621b32c24b99c72619c4c9c35747b794eb111262cf3a8
-
SHA512
0cf2a5d4eddab765e7f8b1a0e56bc51a190b92fdc524ce6584ca64e834007260bd1cb3fa3380c5dea25838c1673dc5fac5e7e3879dbdcb51caf70c78cd5dde86
-
SSDEEP
24576:52PjKr5BNDgk95z+mdcxk3IzWTaKHfhnlMh:kk5BNskumdcK3L//Mh
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
dKjVwpK4 dKjVwpK4 dKjVwpK4 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Request For Quotation RFQ1310.exedescription pid process target process PID 2192 set thread context of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Request For Quotation RFQ1310.exeMSBuild.exepowershell.exepowershell.exepid process 2192 Request For Quotation RFQ1310.exe 2192 Request For Quotation RFQ1310.exe 2380 MSBuild.exe 2380 MSBuild.exe 2492 powershell.exe 2844 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Request For Quotation RFQ1310.exeMSBuild.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2192 Request For Quotation RFQ1310.exe Token: SeDebugPrivilege 2380 MSBuild.exe Token: SeDebugPrivilege 2492 powershell.exe Token: SeDebugPrivilege 2844 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Request For Quotation RFQ1310.exedescription pid process target process PID 2192 wrote to memory of 2844 2192 Request For Quotation RFQ1310.exe powershell.exe PID 2192 wrote to memory of 2844 2192 Request For Quotation RFQ1310.exe powershell.exe PID 2192 wrote to memory of 2844 2192 Request For Quotation RFQ1310.exe powershell.exe PID 2192 wrote to memory of 2844 2192 Request For Quotation RFQ1310.exe powershell.exe PID 2192 wrote to memory of 2492 2192 Request For Quotation RFQ1310.exe powershell.exe PID 2192 wrote to memory of 2492 2192 Request For Quotation RFQ1310.exe powershell.exe PID 2192 wrote to memory of 2492 2192 Request For Quotation RFQ1310.exe powershell.exe PID 2192 wrote to memory of 2492 2192 Request For Quotation RFQ1310.exe powershell.exe PID 2192 wrote to memory of 2600 2192 Request For Quotation RFQ1310.exe schtasks.exe PID 2192 wrote to memory of 2600 2192 Request For Quotation RFQ1310.exe schtasks.exe PID 2192 wrote to memory of 2600 2192 Request For Quotation RFQ1310.exe schtasks.exe PID 2192 wrote to memory of 2600 2192 Request For Quotation RFQ1310.exe schtasks.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe PID 2192 wrote to memory of 2380 2192 Request For Quotation RFQ1310.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request For Quotation RFQ1310.exe"C:\Users\Admin\AppData\Local\Temp\Request For Quotation RFQ1310.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Request For Quotation RFQ1310.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fbWXASX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fbWXASX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C45.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3C45.tmpFilesize
1KB
MD5c977154711a1421b3d82aec8d98d60fb
SHA13d06051ac27a79a38c1787fb0f7d3c49704e0653
SHA256dab5b309056986fe10327c77814880530ae123e2ab11fee8462a5d5810cb82cd
SHA51233d3fa0c62b6e9eb5418d28b2835a496700b9058a4d6de4b88e16b1437ba0f32f7d070bcd5c15d90cd7bb0c4745a5dc92216bf131b6e5d411657f3e5dfa95056
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f637ba6a7f08fb64816fb78e0235c298
SHA1288ce26f783c3a2e3acbfae1e440243b329d3392
SHA256e1cda1f82a3bb809c4536a28584667ae1cf9802e53b24f00ba6a6b7929e970ef
SHA5122c408d96f19cc1d400cc3d82a74c81b97f905c09392313035d7357a25205f711f7438bd8cd246469c4b45e81a82b37f90d791d8e86d92e9a4fa882cf04bbc7c5
-
memory/2192-31-0x0000000074680000-0x0000000074D6E000-memory.dmpFilesize
6.9MB
-
memory/2192-1-0x0000000074680000-0x0000000074D6E000-memory.dmpFilesize
6.9MB
-
memory/2192-2-0x0000000004FE0000-0x0000000005020000-memory.dmpFilesize
256KB
-
memory/2192-3-0x0000000000900000-0x0000000000920000-memory.dmpFilesize
128KB
-
memory/2192-4-0x0000000000620000-0x0000000000634000-memory.dmpFilesize
80KB
-
memory/2192-5-0x0000000005A30000-0x0000000005AB4000-memory.dmpFilesize
528KB
-
memory/2192-0-0x0000000001260000-0x0000000001334000-memory.dmpFilesize
848KB
-
memory/2380-18-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2380-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2380-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2380-22-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2380-24-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2380-20-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2380-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2380-26-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB