Analysis

  • max time kernel
    142s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    07-07-2020 08:33

General

  • Target

    citat.exe

  • Size

    507KB

  • MD5

    4c0812477679e4c34663933be5c5f9fb

  • SHA1

    3c3df6e2bb55f8870b9eb9da60008ea58972a20e

  • SHA256

    66b15ee82b31364bbb038c7a2f60fac0057d01b0865b2b71a4418293fc9e056d

  • SHA512

    35868df44b9faf661bd916d5210e5229863838d609f2056f1b6da9e148d588dba5516aa296adad2f42f74e9b13d7ece042b26424820b038025106fb7f0822aa4

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    kalle.a@yandex.com
  • Password:
    SENEGAL12345

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 4 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
  • Looks for VMWare Tools registry key 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\citat.exe
    "C:\Users\Admin\AppData\Local\Temp\citat.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:676
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YYRzvn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp388C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
        PID:516
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:652

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Virtualization/Sandbox Evasion

    2
    T1497

    Discovery

    Query Registry

    4
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    3
    T1082

    Peripheral Device Discovery

    1
    T1120

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp388C.tmp
      MD5

      43bf79d40f2a6c72710d71f9af8b1d33

      SHA1

      ce80dcc5abb534a984f064df3795930851750b5c

      SHA256

      b172ee93da957a9e5e41ffe8165fafc305753964c499d3e5514f99d7dd6ff1a9

      SHA512

      a7e89ae02f427eb130a2aec85c1261394287ffd533fa2a5be31adce3ad407d851a9234df78cbf964d681843fe036e974503a8ea2d0ba8e250b3261d1d7ed3f2a

    • memory/652-4-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/652-5-0x0000000000446D2E-mapping.dmp
    • memory/652-6-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/652-7-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/676-1-0x0000000000000000-0x0000000000000000-disk.dmp
    • memory/1768-2-0x0000000000000000-mapping.dmp