Analysis
-
max time kernel
100s -
max time network
35s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 09:48
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10
General
-
Target
Quotation.exe
-
Size
510KB
-
MD5
c856ab4630c743620d58a8b909450ad1
-
SHA1
a2637da63688fed49c35a86e4dbaacbdd2799c3f
-
SHA256
0e9d40a6224af32e7fc0878ce4fb51cdb0c9d179f64d3bc5b6a1f1478c512960
-
SHA512
e2ddddd27f56b8a506305ae21e0f44150ef174db7d461963c1f5b1eb5cc8cc28bffae3bf775da7187d50fa7dd7d817370aaa1ab41dc76b8a7c5dfb82867fae4d
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.actionassist.co.uk - Port:
587 - Username:
[email protected] - Password:
benjamin76
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/848-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/848-5-0x0000000000447F0E-mapping.dmp family_agenttesla behavioral1/memory/848-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/848-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Quotation.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Quotation.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Quotation.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Quotation.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Quotation.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Quotation.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quotation.exedescription pid process target process PID 1500 set thread context of 848 1500 Quotation.exe Quotation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Quotation.exepid process 848 Quotation.exe 848 Quotation.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Quotation.exedescription pid process Token: SeDebugPrivilege 848 Quotation.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Quotation.exepid process 848 Quotation.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Quotation.exedescription pid process target process PID 1500 wrote to memory of 1800 1500 Quotation.exe schtasks.exe PID 1500 wrote to memory of 1800 1500 Quotation.exe schtasks.exe PID 1500 wrote to memory of 1800 1500 Quotation.exe schtasks.exe PID 1500 wrote to memory of 1800 1500 Quotation.exe schtasks.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe PID 1500 wrote to memory of 848 1500 Quotation.exe Quotation.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qjojKsx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2635.tmp"2⤵
- Creates scheduled task(s)
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
7f812793b930ae6385bb8a80fd8aab20
SHA1f46ff70a185a14b453538591bca508afd61f7fdd
SHA2569f05187bc4ac251c12d2d234b4ff9048ac892b189e5f94c07e95761d2157ab9a
SHA51275653edf412b41fe06549619a82c35e7ea156f51cadb7f985dd4224fe2c868c048c993f3ce7e960230bb34777f51facbf9b46a7af898b16a937aeb06d4d0d626