Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quotation RFQ1310.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Request For Quotation RFQ1310.exe
Resource
win10v2004-20241007-en
General
-
Target
Request For Quotation RFQ1310.exe
-
Size
1.4MB
-
MD5
bdfd5584de8569ac84cd5566875c5464
-
SHA1
3130ac63f0109d4cd5ca00f96d05c29df5f73dfb
-
SHA256
d1ed381d12ccad419dcc8e8fc14179ef453e03ddd57d6842955ea9ec5176f484
-
SHA512
848b932396628c3cfabdf350c95b75b38a29d2b575ca4a46da1e1fd469038fb8d388cc1febc84914a77dde3247d98f3117765cb9ad1deb58916dd42d7399e99d
-
SSDEEP
24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8axkozf5RxwxnpPF+5NBL2mV:4TvC/MTQYxsWR7axkozuxnp2N8m
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Esher.vbs Esher.exe -
Executes dropped EXE 2 IoCs
pid Process 2120 Esher.exe 1904 Esher.exe -
Loads dropped DLL 1 IoCs
pid Process 1504 Request For Quotation RFQ1310.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000800000001933b-4.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1904 set thread context of 2660 1904 Esher.exe 34 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Request For Quotation RFQ1310.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Esher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Esher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2660 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2120 Esher.exe 1904 Esher.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2660 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 1904 Esher.exe 1904 Esher.exe 1904 Esher.exe 1904 Esher.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 1504 Request For Quotation RFQ1310.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 2120 Esher.exe 1904 Esher.exe 1904 Esher.exe 1904 Esher.exe 1904 Esher.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1504 wrote to memory of 2120 1504 Request For Quotation RFQ1310.exe 31 PID 1504 wrote to memory of 2120 1504 Request For Quotation RFQ1310.exe 31 PID 1504 wrote to memory of 2120 1504 Request For Quotation RFQ1310.exe 31 PID 1504 wrote to memory of 2120 1504 Request For Quotation RFQ1310.exe 31 PID 2120 wrote to memory of 2740 2120 Esher.exe 32 PID 2120 wrote to memory of 2740 2120 Esher.exe 32 PID 2120 wrote to memory of 2740 2120 Esher.exe 32 PID 2120 wrote to memory of 2740 2120 Esher.exe 32 PID 2120 wrote to memory of 2740 2120 Esher.exe 32 PID 2120 wrote to memory of 2740 2120 Esher.exe 32 PID 2120 wrote to memory of 2740 2120 Esher.exe 32 PID 2120 wrote to memory of 1904 2120 Esher.exe 33 PID 2120 wrote to memory of 1904 2120 Esher.exe 33 PID 2120 wrote to memory of 1904 2120 Esher.exe 33 PID 2120 wrote to memory of 1904 2120 Esher.exe 33 PID 1904 wrote to memory of 2660 1904 Esher.exe 34 PID 1904 wrote to memory of 2660 1904 Esher.exe 34 PID 1904 wrote to memory of 2660 1904 Esher.exe 34 PID 1904 wrote to memory of 2660 1904 Esher.exe 34 PID 1904 wrote to memory of 2660 1904 Esher.exe 34 PID 1904 wrote to memory of 2660 1904 Esher.exe 34 PID 1904 wrote to memory of 2660 1904 Esher.exe 34 PID 1904 wrote to memory of 2660 1904 Esher.exe 34 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request For Quotation RFQ1310.exe"C:\Users\Admin\AppData\Local\Temp\Request For Quotation RFQ1310.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Okeghem\Esher.exe"C:\Users\Admin\AppData\Local\Temp\Request For Quotation RFQ1310.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Request For Quotation RFQ1310.exe"3⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Okeghem\Esher.exe"C:\Users\Admin\AppData\Local\Okeghem\Esher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Okeghem\Esher.exe"4⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2660
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5bdfd5584de8569ac84cd5566875c5464
SHA13130ac63f0109d4cd5ca00f96d05c29df5f73dfb
SHA256d1ed381d12ccad419dcc8e8fc14179ef453e03ddd57d6842955ea9ec5176f484
SHA512848b932396628c3cfabdf350c95b75b38a29d2b575ca4a46da1e1fd469038fb8d388cc1febc84914a77dde3247d98f3117765cb9ad1deb58916dd42d7399e99d